Responsive video embed < 0.5.1 – Contributor+ Stored XSS | CVE 2024-5475 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

As a contributor, create a post with the following shortcode: [rve src='" onload=alert(/XSS/) " ']

The XSS will be triggered when any user will (pre)view the post

Affects Plugins

responsive-video-embed

Fixed in 0.5.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Felipe Caon

Submitter

caon

Submitter website

https://caon.io

Verified

Yes

WPVDB ID

cee66543-b5d6-4205-8f9b-0febd7fee445

Timeline

Publicly Published

2024-05-30 (about 1 year ago)

Added

2024-05-30 (about 1 year ago)

Last Updated

2024-05-30 (about 1 year ago)

Other

Published

Title

Published

2025-11-20

Title

WP Delete Post Copies < 6.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting

Published

2024-03-28

Title

WP-CRM System < 3.2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2023-08-18

Title

WP VR < 8.3.5 - Reflected XSS

Published

2023-10-29

Title

Shortcode Menu <= 3.2 - Contributor+ Stored Cross-Site Scripting

Published

2024-05-28

Title

FooBox (Free and Premium) < 2.7.28 - Admin+ Stored XSS