EUVD-2026-60926
GHSA-4834-x8j6-66m3
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Contributor auth required (PR:L), victim interaction needed (UI:R), scope changes to admin browser (S:C); no meaningful availability impact from XSS alone.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
AnalysisAI
Stored Cross-Site Scripting in the Video Conferencing with Zoom WordPress plugin (≤ 4.6.8) allows authenticated contributors to inject malicious scripts that execute in the browsers of higher-privileged users such as editors or administrators. The CVSS scope-changed metric (S:C) confirms the injected payload crosses security boundaries, enabling session hijacking or unauthorized administrative actions against victim accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess or obtain a Contributor-level (or higher) WordPress account on the target site, as confirmed by the CVSS PR:L metric - unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 medium score reflects a balanced threat picture: AV:N indicates network reachability, but PR:L constrains the attack to users who already hold contributor accounts, and UI:R requires a higher-privileged user to interact with the malicious content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Video Conferencing with Zoom plugin to a version beyond 4.6.8 as soon as a patched release is available from the WordPress plugin repository or the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Video Conferencing With Zoom
View allThe Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users A
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoo
Unauthenticated access to Zoom SDK credentials is possible in the Video Conferencing with Zoom WordPress plugin (version
Missing authorization in Deepen Bajracharya's Video Conferencing with Zoom WordPress plugin through version 4.6.6 allows
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded e
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today