Videowhisper Live Streaming Integration: Cross-site scripting
Videowhisper Live Streaming Integration is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
- Component
- Videowhisper Live Streaming Integration
- Plugin slug
videowhisper-live-streaming-integration- Affected
- See vendor advisory
- Safe version
- See mitigation notes
- Published
- Mar 19, 2018
This CVE was published Mar 19, 2018 and is one of 13 known issues for this plugin.
Patch or disable the affected component.
Update Videowhisper Live Streaming Integration to a release outside the affected range, or disable and remove it until a fixed version is available.
Technical description
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap CVE-2014-1906.4.
NVD vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N