Approved changes feed: RSS · Atom
cpe:2.3:a:jconti:videozen:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Jconti (2dc9cdbd-b425-5a7f-8a9d-cdd9bfe261d4) |
|---|---|
| Product | Videozen (e9b113fb-6be2-50c0-9628-bddc5ed91a11) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-6439 |
vulnerable | 2026-06-08 08:07:04.782788 |
VideoZen <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'VideoZen available subtitles languages' Field
MEDIUM (4.4)
The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping in the videozen_conf() function. The 'lang' POST parameter is stored directly via update_option() without any sanitization, and later echoed inside a <textarea> element without applying esc_textarea() or any equivalent escaping function. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts into the plugin settings page that will execute whenever any user accesses that page.
Published: 2026-04-17T08:28:26.200Z
Updated: 2026-04-20T14:59:14.759Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.