Video Lessons Manager – Admin+ Stored Cross-Site Scripting | CVE 2021-24713 | Plugin Vulnerabilities

Description

The plugins do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks

Proof of Concept

* Open the CM Video Lesson Plugin's Settings page.
* Click on Label Tab
* Enter payload like [ "><script>alert(1)</script> [ into the "channel" or "channels" fields.
* Save and the payload will execute on future visits to the Settings page.

Affects Plugins

cm-video-lesson-manager

Fixed in 1.7.2

cm-video-lesson-manager-pro

Fixed in 3.5.9

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Shivam Rai

Submitter

Shivam Rai

Submitter twitter

Verified

Yes

WPVDB ID

4a90be69-41eb-43e9-962d-34316497b4df

Timeline

Publicly Published

2021-10-25 (about 4 years ago)

Added

2021-10-25 (about 4 years ago)

Last Updated

2022-04-14 (about 3 years ago)

Other

Published

Title

Published

2024-08-21

Title

WooCommerce < 9.2 - Contributor+ Stored XSS

Published

2022-12-28

Title

OneClick Chat to Order < 1.0.4.2 - Contributor+ Stored XSS via Shortcode

Published

2025-03-02

Title

Random Image Selector <= 2.4 - Reflected Cross-Site Scripting

Published

2022-10-05

Title

Log HTTP Requests < 1.3.2 - Stored Cross-Site Scripting

Published

2019-03-22

Title

Link Checker < 1.17.0 - XSS