Read the docs
TI-2013-01794 Aliases CVE-2013-2022GHSA-3jcq-cwr7-6332

Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the…

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter. NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.

Why it matters now

EPSS 0.02735 86th percentileScored 2026-11-07
Fix Fixed jplayer (npm): 2.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—jplayer (npm)before 2.3.02.3.0Patch availableGHSA-3jcq-cwr7-6332
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • jplayer (npm) Vendor— Affected before 2.3.0 Fixed in 2.3.0 Patch available GHSA-3jcq-cwr7-6332

CPE configurations NVD · 69

CPEVersionsRoleVendor
cpe:2.3:a:happyworm:jplayer:*:*:*:*:*:*:*:*up to 2.2.22VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:0.2.1:beta:*:*:*:*:*:*0.2.1 betaVulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:0.2.2:beta:*:*:*:*:*:*0.2.2 betaVulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:0.2.3:beta:*:*:*:*:*:*0.2.3 betaVulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:0.2.4:beta:*:*:*:*:*:*0.2.4 betaVulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:0.2.5:beta:*:*:*:*:*:*0.2.5 betaVulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableHappyworm
  • cpe:2.3:a:happyworm:jplayer:*:*:*:*:*:*:*:* Versions up to 2.2.22 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:0.2.1:beta:*:*:*:*:*:* Versions 0.2.1 beta Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:0.2.2:beta:*:*:*:*:*:* Versions 0.2.2 beta Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:0.2.3:beta:*:*:*:*:*:* Versions 0.2.3 beta Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:0.2.4:beta:*:*:*:*:*:* Versions 0.2.4 beta Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:0.2.5:beta:*:*:*:*:*:* Versions 0.2.5 beta Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Happyworm
Show 59 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:happyworm:jplayer:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.3:*:*:*:*:*:*:*2.0.3VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.4:*:*:*:*:*:*:*2.0.4VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.5:*:*:*:*:*:*:*2.0.5VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.6:*:*:*:*:*:*:*2.0.6VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.7:*:*:*:*:*:*:*2.0.7VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.8:*:*:*:*:*:*:*2.0.8VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.9:*:*:*:*:*:*:*2.0.9VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.10:*:*:*:*:*:*:*2.0.10VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.11:*:*:*:*:*:*:*2.0.11VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.12:*:*:*:*:*:*:*2.0.12VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.13:*:*:*:*:*:*:*2.0.13VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.14:*:*:*:*:*:*:*2.0.14VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.15:*:*:*:*:*:*:*2.0.15VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.16:*:*:*:*:*:*:*2.0.16VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.17:*:*:*:*:*:*:*2.0.17VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.18:*:*:*:*:*:*:*2.0.18VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.19:*:*:*:*:*:*:*2.0.19VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.20:*:*:*:*:*:*:*2.0.20VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.21:*:*:*:*:*:*:*2.0.21VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.22:*:*:*:*:*:*:*2.0.22VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.23:*:*:*:*:*:*:*2.0.23VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.24:*:*:*:*:*:*:*2.0.24VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.25:*:*:*:*:*:*:*2.0.25VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.26:*:*:*:*:*:*:*2.0.26VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.27:*:*:*:*:*:*:*2.0.27VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.28:*:*:*:*:*:*:*2.0.28VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.29:*:*:*:*:*:*:*2.0.29VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.30:*:*:*:*:*:*:*2.0.30VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.31:*:*:*:*:*:*:*2.0.31VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.32:*:*:*:*:*:*:*2.0.32VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.33:*:*:*:*:*:*:*2.0.33VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.34:*:*:*:*:*:*:*2.0.34VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.35:*:*:*:*:*:*:*2.0.35VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.0.36:*:*:*:*:*:*:*2.0.36VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.1.2:*:*:*:*:*:*:*2.1.2VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.1.3:*:*:*:*:*:*:*2.1.3VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.1.4:*:*:*:*:*:*:*2.1.4VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.1.5:*:*:*:*:*:*:*2.1.5VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.1.6:*:*:*:*:*:*:*2.1.6VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.10:*:*:*:*:*:*:*2.2.10VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.11:*:*:*:*:*:*:*2.2.11VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.12:*:*:*:*:*:*:*2.2.12VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.13:*:*:*:*:*:*:*2.2.13VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.14:*:*:*:*:*:*:*2.2.14VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.15:*:*:*:*:*:*:*2.2.15VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.16:*:*:*:*:*:*:*2.2.16VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.17:*:*:*:*:*:*:*2.2.17VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.18:*:*:*:*:*:*:*2.2.18VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.19:*:*:*:*:*:*:*2.2.19VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.20:*:*:*:*:*:*:*2.2.20VulnerableHappyworm
cpe:2.3:a:happyworm:jplayer:2.2.21:*:*:*:*:*:*:*2.2.21VulnerableHappyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.7:*:*:*:*:*:*:* Versions 2.0.7 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.8:*:*:*:*:*:*:* Versions 2.0.8 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.9:*:*:*:*:*:*:* Versions 2.0.9 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.10:*:*:*:*:*:*:* Versions 2.0.10 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.11:*:*:*:*:*:*:* Versions 2.0.11 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.12:*:*:*:*:*:*:* Versions 2.0.12 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.13:*:*:*:*:*:*:* Versions 2.0.13 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.14:*:*:*:*:*:*:* Versions 2.0.14 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.15:*:*:*:*:*:*:* Versions 2.0.15 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.16:*:*:*:*:*:*:* Versions 2.0.16 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.17:*:*:*:*:*:*:* Versions 2.0.17 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.18:*:*:*:*:*:*:* Versions 2.0.18 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.19:*:*:*:*:*:*:* Versions 2.0.19 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.20:*:*:*:*:*:*:* Versions 2.0.20 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.21:*:*:*:*:*:*:* Versions 2.0.21 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.22:*:*:*:*:*:*:* Versions 2.0.22 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.23:*:*:*:*:*:*:* Versions 2.0.23 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.24:*:*:*:*:*:*:* Versions 2.0.24 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.25:*:*:*:*:*:*:* Versions 2.0.25 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.26:*:*:*:*:*:*:* Versions 2.0.26 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.27:*:*:*:*:*:*:* Versions 2.0.27 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.28:*:*:*:*:*:*:* Versions 2.0.28 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.29:*:*:*:*:*:*:* Versions 2.0.29 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.30:*:*:*:*:*:*:* Versions 2.0.30 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.31:*:*:*:*:*:*:* Versions 2.0.31 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.32:*:*:*:*:*:*:* Versions 2.0.32 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.33:*:*:*:*:*:*:* Versions 2.0.33 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.34:*:*:*:*:*:*:* Versions 2.0.34 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.35:*:*:*:*:*:*:* Versions 2.0.35 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.0.36:*:*:*:*:*:*:* Versions 2.0.36 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.1.5:*:*:*:*:*:*:* Versions 2.1.5 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.1.6:*:*:*:*:*:*:* Versions 2.1.6 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.10:*:*:*:*:*:*:* Versions 2.2.10 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.11:*:*:*:*:*:*:* Versions 2.2.11 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.12:*:*:*:*:*:*:* Versions 2.2.12 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.13:*:*:*:*:*:*:* Versions 2.2.13 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.14:*:*:*:*:*:*:* Versions 2.2.14 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.15:*:*:*:*:*:*:* Versions 2.2.15 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.16:*:*:*:*:*:*:* Versions 2.2.16 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.17:*:*:*:*:*:*:* Versions 2.2.17 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.18:*:*:*:*:*:*:* Versions 2.2.18 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.19:*:*:*:*:*:*:* Versions 2.2.19 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.20:*:*:*:*:*:*:* Versions 2.2.20 Vulnerable ·Happyworm
  • cpe:2.3:a:happyworm:jplayer:2.2.21:*:*:*:*:*:*:* Versions 2.2.21 Vulnerable ·Happyworm

Remediation

  • Fix · GHSA-3jcq-cwr7-6332 jplayer (npm) Fixed in 2.3.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-2022
  2. 2026-10-03 Alias added: GHSA-3jcq-cwr7-6332

References

Advisory 1

Other 11

  • TI-2013-01717 Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the… CVSS 2.0MEDIUM 4.3
  • TI-2013-01795 Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences