CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
Mine CloudVod plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘audio’ parameter in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in Mine CloudVod WordPress plugin versions up to 2.1.10 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript through the 'audio' parameter due to insufficient input sanitization and output escaping. When injected pages are accessed by other users, the malicious scripts execute in their browsers, potentially compromising site security and user data. No public exploit code or active exploitation has been confirmed at analysis time.
Technical ContextAI
The vulnerability exists in the audio player rendering functionality of the Mine CloudVod WordPress plugin, specifically in the render.php file at line 66 where the 'audio' parameter is processed. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a Stored XSS vulnerability where user-supplied input is reflected directly into HTML output without proper sanitization or escaping. WordPress plugins handling user-controlled parameters in shortcodes or AJAX handlers must sanitize input using functions like sanitize_text_field() and escape output using esc_attr(), esc_url(), or wp_kses_post() depending on context. The plugin fails to implement these security controls on the 'audio' parameter, allowing injection of malicious script tags or event handlers that persist in the WordPress database and execute whenever the page renders.
Affected ProductsAI
Mine CloudVod WordPress plugin (all versions up to and including 2.1.10). The vulnerability was introduced before version 2.1.10 and confirmed present in that release. Patch information indicates version 2.2.0 contains fixes, as evidenced by the WordPress plugin repository changeset reference comparing the two versions. The plugin is available at https://wordpress.org/plugins/mine-cloudvod/ and runs on all WordPress installations where this plugin is installed and activated.
RemediationAI
Update the Mine CloudVod plugin to version 2.2.0 or later, which includes patches addressing the insufficient input sanitization in the audio parameter handling. Site administrators should navigate to their WordPress plugin dashboard, locate Mine CloudVod, and click 'Update' to apply the patched version. As an interim workaround pending updates, restrict Contributor-level access to trusted users only and review user accounts to remove any unnecessary elevated privileges. Additionally, use WordPress security plugins to monitor for suspicious content in posts and pages. For detailed information and patch availability confirmation, consult the official plugin advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3cd194-3fb8-4dd9-905e-051d5de68b66?source=cve and the WordPress plugin repository at https://wordpress.org/plugins/mine-cloudvod/.
Share
External POC / Exploit Code
Leaving vuln.today