WordPress Plugin Vulnerabilities

Flash & HTML5 Video < 2.5.32 - Authenticated (Subscriber+) Information Exposure

Description

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.31 via the h5vp_export_data() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract potentially sensitive information from exports.

Affects Plugins

Plugin icon
html5-video-player
Fixed in 2.5.32

References

CVE
CVE-2024-43319
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/604862d9-e032-4806-8a14-3e4ad0ae1ee2

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
835aaf16-347e-49bb-8dea-3608ffbc109e

Timeline

Publicly Published
2024-08-16 (about 2 years ago)
Added
2024-08-22 (about 2 years ago)
Last Updated
2024-08-22 (about 2 years ago)

Other

Published
Title
Published
2025-01-07
Title
140+ Widgets | Xpro Addons For Elementor – FREE < 1.4.6.3 - Authenticated (Contributor+) Post Disclosure via Post Duplication
Published
2026-02-18
Title
Web Accessibility by accessiBe < 2.12 - Unauthenticated Sensitive Information Exposure
Published
2024-07-15
Title
XCloner < 4.7.4 - Unauthenticated Full Path Disclosure
Published
2024-11-08
Title
CE21 Suite <= 2.2.0 - JWT Token Disclosure
Published
2022-05-18
Title
Log WP_Mail <= 0.1 - Email Logs Publicly Accessible