EUVD-2026-23399
GHSA-gc8m-6q8j-fh75
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping in the videozen_conf() function. The 'lang' POST parameter is stored directly via update_option() without any sanitization, and later echoed inside a <textarea> element without applying esc_textarea() or any equivalent escaping function. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts into the plugin settings page that will execute whenever any user accesses that page.
AnalysisAI
Stored Cross-Site Scripting in VideoZen WordPress plugin versions up to 1.0.1 allows authenticated administrators to inject arbitrary JavaScript into plugin settings that executes for all users accessing the settings page. The 'lang' POST parameter in the videozen_conf() function is stored without sanitization and output without escaping, enabling privilege-abusing admins to compromise any WordPress installation running the vulnerable plugin. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Share
External POC / Exploit Code
Leaving vuln.today