EUVD-2026-23399
GHSA-gc8m-6q8j-fh75
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping in the videozen_conf() function. The 'lang' POST parameter is stored directly via update_option() without any sanitization, and later echoed inside a <textarea> element without applying esc_textarea() or any equivalent escaping function. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts into the plugin settings page that will execute whenever any user accesses that page.
AnalysisAI
Stored Cross-Site Scripting in VideoZen WordPress plugin versions up to 1.0.1 allows authenticated administrators to inject arbitrary JavaScript into plugin settings that executes for all users accessing the settings page. The 'lang' POST parameter in the videozen_conf() function is stored without sanitization and output without escaping, enabling privilege-abusing admins to compromise any WordPress installation running the vulnerable plugin. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
VideoZen is a WordPress plugin (CPE: cpe:2.3:a:jconti:videozen:*:*:*:*:*:*:*:*) that handles video embedding and configuration. The vulnerability resides in the videozen_conf.php file at lines 24 and 69, where user-supplied POST data from the 'lang' parameter is passed directly to WordPress's update_option() function without input sanitization (line 24), then retrieved and echoed into a textarea HTML element without output escaping (line 69). The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) occurs because the plugin fails to apply standard WordPress escaping functions like sanitize_text_field() on input and esc_textarea() on output. This is a classic stored XSS vulnerability where malicious data persists in the WordPress options table and executes each time the settings page loads.
RemediationAI
Update VideoZen to the latest patched version available from the WordPress plugin repository. The fix requires sanitizing the 'lang' POST parameter using sanitize_text_field() or similar before passing to update_option() (line 24), and escaping the stored value with esc_textarea() when outputting to the HTML textarea element (line 69). If an immediate update is unavailable, restrict WordPress Administrator role to trusted users only and monitor the wp_options table for unexpected 'videozen_*' entries containing script tags or suspicious JavaScript code. Disable the VideoZen plugin entirely until patched if high-risk admin accounts (shared logins, service accounts) exist. Note: disabling the plugin may break video functionality on dependent pages, requiring alternative video embedding solutions.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today