Skip to content
Sign in
Not rated

CVE-2022-2189 The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before…

Description

The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

Affected products and versions

Product Affected versions Fixed in
WP Video Lightbox 1.9 earliest → < 1.9.5 1.9.5

Other CVEs of WP Video Lightbox

The 3 CVEs of WP Video Lightbox →
CVE-2022-4465 The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before… 5.4 Medium CVE-2021-24665 The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users… Not rated
Track this CVE