CVE-2022-3984: Flowplayer Video Player < 1.0.5 - Contributor+ Stored XSS
Published Dec 19, 2022
·Updated
The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Affected Software
1 affected component
Wphowto Flowplayer Video Player Wordpress<1.0.5
Event History
Dec 19, 2022
CVE Published
via MITRE·01:41 PM
Data Sourced
via MITRE·01:41 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2022-3984.
2
What is the severity rating for CVE-2022-3984?
The severity rating for CVE-2022-3984 is medium (5.4).
3
What is the affected software?
The affected software is the Flowplayer Video Player WordPress plugin version up to 1.0.5.
4
What is the risk of CVE-2022-3984?
CVE-2022-3984 poses a risk of Stored Cross-Site Scripting (XSS) attacks.
5
How can I fix CVE-2022-3984?
To fix CVE-2022-3984, update the Flowplayer Video Player WordPress plugin to version 1.0.5 or higher.