streamcast
streamcast (streamcast) is a WordPress plugin with 3 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 7.2.
streamcastCVE-2026-116849: StreamCast: Stored cross-site scripting
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 2.4.6.
| Safe version |
|
||
|---|---|---|---|
| Oct 29, 2026 |
CVE-2026-116849
StreamCast: Stored cross-site scripting
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 2.4.6.
|
2.4.7 |
CVE6.5
|
| Oct 10, 2026 |
CVE-2026-62030
StreamCast: Server-side request forgery
An unauthenticated caller can cause the server to make a request to an attacker-influenced destination. This can cross a network trust boundary if the server can reach services inaccessible to the caller. The export does not disclose the endpoint, URL parameter, protocols, redirect behavior or a particular internal target. Affected versions: <= 2.4.5. No fixed release is confirmed.
|
See mitigation notes |
CVE7.2
|
| Aug 12, 2024 |
CVE-2024-43148
StreamCast: Cross-site scripting
StreamCast is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
|