CVE-2024-2428 – The Ultimate Video Player For WordPress < 2.2.3 - Contributor+ Stored XSS

https://notcve.org/view.php?id=CVE-2024-2428

The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to perform Stored XSS attacks El complemento Ultimate Video Player For WordPress para WordPress anterior a 2.2.3 no tiene una verificación de capacidad adecuada al actualizar su configuración a través de una ruta REST, lo que permite a Contributor y a los usuarios superiores actualizarlos. Además, debido a la falta de escape en una de las configuraciones, esto también les permite realizar ataques XSS almacenados. The The Ultimate Video Player For WordPress – by Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings in all versions up to, and including, 2.2.2 due to missing authorization on a REST API endpoint and insufficient input sanitization and output escaping on the settinfs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/4832e223-4571-4b45-97db-2fd403797c49 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •