Video Background Block Use Video As Background In The Section
Monthly
Unauthenticated cross-site scripting in the WordPress plugin Video Background Block (versions 2.0.3 and earlier) lets remote attackers supply data to the plugin's video-background section rendering that is not properly neutralized before being written into a page, so arbitrary script executes in the browser of any visitor who loads the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms no authentication is required to deliver the payload but that exploitation depends on a victim loading or interacting with the crafted page, and the scope change indicates the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory as reported does not cite a fixed version, so risk is confined to WordPress sites running this specific bplugins plugin at an unpatched release.
Unauthenticated cross-site scripting in the WordPress plugin Video Background Block (versions 2.0.3 and earlier) lets remote attackers supply data to the plugin's video-background section rendering that is not properly neutralized before being written into a page, so arbitrary script executes in the browser of any visitor who loads the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms no authentication is required to deliver the payload but that exploitation depends on a victim loading or interacting with the crafted page, and the scope change indicates the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory as reported does not cite a fixed version, so risk is confined to WordPress sites running this specific bplugins plugin at an unpatched release.