Read the docs

bPlugins

Records124All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high27CVSS 7.0–8.9

Exploited now

bPlugins records in CISA KEV

No bPlugins vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Html5 Video Player 6 records MEDIUM Button Block 4 records LOW Html5 Audio Player 3 records MEDIUM Icons Font Loader 3 records MEDIUM Document Embedder 2 records LOW Easy Twitter Feed 1 record LOW Pdf Poster 1 record LOW Polo Video Gallery 1 record LOW

Records

6 records in Html5 Video Player · all components

TI-2024-05133 CVE-2024-5522 · GHSA-3vf3-j8cr-x4g6

HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

Priority MEDIUM 62

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02639 Published 2024-06-20 Fixed in 2.5.27 CWE-89
TI-2024-00982 CVE-2024-1061 · GHSA-89c9-2mcj-c9gr

SQL injection in html5-video-player

Priority MEDIUM 61

The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.11125 Published 2024-01-30 Fixed in 2.5.25 CWE-89
TI-2024-28948 CVE-2024-43296 · GHSA-qf8p-5g4m-c6xm

WordPress HTML5 Video Player plugin <= 2.5.30 - Broken Access Control vulnerability

Priority LOW 38

Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flash & HTML5 Video: from n/a through 2.5.30.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00399 Published 2024-11-01 No fix listed CWE-862
TI-2023-05943 CVE-2023-6485 · GHSA-p5mw-mg37-2vrh

Html5 Video Player < 2.5.19 - Subscriber+ Stored XSS

Priority LOW 25

The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00527 Published 2024-01-01 Fixed in 2.5.19 CWE-79
TI-2024-07162 CVE-2024-7727 · GHSA-63g5-j8m9-wc9f

Missing authorization in bPlugins HTML5 Video Player – Embed and Play Videos in Custom…

Priority LOW 24

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vp_ajax_handler' ajax…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00392 Published 2024-09-11 No fix listed CWE-862
TI-2024-07156 CVE-2024-7721 · GHSA-6m95-wprq-2gv6

Missing authorization in bPlugins HTML5 Video Player – Embed and Play Videos in Custom…

Priority LOW 20

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_password' function in all versions up to,…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00309 Published 2024-09-11 No fix listed CWE-862
Open these records in search →