Featured Video Plus
Monthly
Stored Cross-Site Scripting in the Featured Video Plus WordPress plugin (versions ≤ 2.3.3) allows contributor-role users to inject persistent malicious scripts into featured video fields. When a higher-privileged user such as an editor or administrator views the affected post, the script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive data exposure in the Featured Video Plus WordPress plugin (versions <= 2.3.3) allows any remote attacker to retrieve sensitive information without credentials via a crafted network request. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable against any default installation of the plugin with no prerequisites beyond network access. Classified under CWE-201, the plugin inserts sensitive information into its sent data, making it passively harvestable. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Featured Video Plus WordPress plugin (versions ≤ 2.3.3) allows contributor-role users to inject persistent malicious scripts into featured video fields. When a higher-privileged user such as an editor or administrator views the affected post, the script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive data exposure in the Featured Video Plus WordPress plugin (versions <= 2.3.3) allows any remote attacker to retrieve sensitive information without credentials via a crafted network request. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable against any default installation of the plugin with no prerequisites beyond network access. Classified under CWE-201, the plugin inserts sensitive information into its sent data, making it passively harvestable. No public exploit code or CISA KEV listing has been identified at time of analysis.