EUVD-2026-32053
GHSA-6rcp-q8qr-wh4c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Responsive Video Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rem_video' shortcode in versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes (notably 'id' and 'list') in the video_shortcode() function, which are concatenated directly into an HTML iframe's src attribute without escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Responsive Video Embedder WordPress plugin (versions ≤ 0.1) allows authenticated attackers with contributor-level access or above to persistently inject arbitrary JavaScript into WordPress pages via unsanitized shortcode attributes. The root cause is direct, unescaped concatenation of user-supplied 'id' and 'list' attributes into an HTML iframe src attribute inside the video_shortcode() function. Because the CVSS scope is Changed (S:C), injected scripts execute in the browsers of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or malicious redirects against site visitors. No active exploitation has been confirmed and EPSS is very low (0.03%, 9th percentile), but the contributor-level entry bar makes this relevant on multi-author WordPress sites.
Technical ContextAI
The Responsive Video Embedder is a WordPress plugin that registers a [rem_video] shortcode, handled by the video_shortcode() function at responsive-video-embedder.php lines 152 and 167. The function accepts user-controlled shortcode attributes - notably 'id' and 'list' - and constructs an HTML iframe element by directly concatenating these values into the src attribute string without applying WordPress sanitization functions (e.g., esc_attr(), esc_url()) or output escaping. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) - Stored variant - because the unsanitized payload is persisted to the database via the post content and later rendered to all page visitors. The Changed scope (S:C in CVSS 3.1) reflects that the injected script executes in the victim's browser security context, separate from the WordPress application context where the payload was stored, enabling cross-context impact.
RemediationAI
No patched version has been identified in the available intelligence data - neither the NVD references nor the Wordfence advisory cite a fixed release. Site administrators should immediately deactivate and remove the Responsive Video Embedder plugin (versions ≤ 0.1) until a patched version is published by the vendor. Monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/00f5cf90-cc63-4e51-b1be-1152abefc59d for patch availability. As a compensating control, restrict contributor-level post publishing so that shortcode output requires editor or administrator review before going live - this breaks the stored-XSS execution path without removing the role entirely. Alternatively, use a capability management plugin to revoke shortcode execution rights from contributors. Note that disabling the plugin will break any existing [rem_video] shortcode embeds site-wide, which should be communicated to content authors. Wordfence's firewall (if installed) may provide virtual patching for this vulnerability as a secondary control.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today