Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: bPlugins Component: Html5 Video Player Clear all filters
TI-2024-28948 CVE-2024-43296 · GHSA-qf8p-5g4m-c6xm

WordPress HTML5 Video Player plugin <= 2.5.30 - Broken Access Control vulnerability

Priority LOW 38

Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flash & HTML5 Video: from n/a through 2.5.30.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00399 Published 2024-11-01 No fix listed CWE-862
TI-2024-07162 CVE-2024-7727 · GHSA-63g5-j8m9-wc9f

Missing authorization in bPlugins HTML5 Video Player – Embed and Play Videos in Custom…

Priority LOW 24

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vp_ajax_handler' ajax…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00392 Published 2024-09-11 No fix listed CWE-862
TI-2024-07156 CVE-2024-7721 · GHSA-6m95-wprq-2gv6

Missing authorization in bPlugins HTML5 Video Player – Embed and Play Videos in Custom…

Priority LOW 20

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_password' function in all versions up to,…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00309 Published 2024-09-11 No fix listed CWE-862
TI-2024-05133 CVE-2024-5522 · GHSA-3vf3-j8cr-x4g6

HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

Priority MEDIUM 62

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02639 Published 2024-06-20 Fixed in 2.5.27 CWE-89
TI-2024-00982 CVE-2024-1061 · GHSA-89c9-2mcj-c9gr

SQL injection in html5-video-player

Priority MEDIUM 61

The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.11125 Published 2024-01-30 Fixed in 2.5.25 CWE-89
TI-2023-05943 CVE-2023-6485 · GHSA-p5mw-mg37-2vrh

Html5 Video Player < 2.5.19 - Subscriber+ Stored XSS

Priority LOW 25

The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00527 Published 2024-01-01 Fixed in 2.5.19 CWE-79