WordPress Plugin Vulnerabilities

Dewplayer - dewplayer-vinyl.swf xml Parameter XML File H&ling XSS

Description

The dewplayer-flash-mp3-player WordPress plugin was affected by a dewplayer-vinyl.swf xml Parameter XML File H&ling XSS security vulnerability.

Affects Plugins

Plugin icon
dewplayer-flash-mp3-player
No known fix

References

URL
https://packetstormsecurity.com/files/#124582/
URL
https://seclists.org/fulldisclosure/2013/Dec/192

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Verified
No
WPVDB ID
90e6db55-e9c6-46bc-b06f-bd3003755c5b

Timeline

Publicly Published
2014-08-01 (about 11 years ago)
Added
2014-08-01 (about 11 years ago)
Last Updated
2019-10-21 (about 6 years ago)

Other

Published
Title
Published
2025-02-01
Title
WP Event Aggregator < 1.8.3 - Reflected Cross-Site Scripting
Published
2023-08-16
Title
Stock Exporter for WooCommerce < 1.2.0 - Reflected XSS
Published
2020-07-13
Title
Jetapo < 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Published
2024-03-15
Title
ElementsKit Elementor addons < 3.0.5 - Contributor+ Stored XSS
Published
2024-04-30
Title
Pliska < 0.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Display Name