Tipsandtricks Hq Wp Video Lightbox vulnerabilities

3 vulnerabilities

Known vulnerabilities in Tipsandtricks Hq Wp Video Lightbox, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.4CVE-2021-24665tipsandtricks-hqwp_video_lightbox+2
EPSS score
0.62%
The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks6.1CVE-2022-2189tipsandtricks-hqwp_video_lightbox+2
EPSS score
0.74%
The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers6.4CVE-2022-4465tipsandtricks-hqwp_video_lightbox+2
EPSS score
0.47%
The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.