CVE-2024-13156

Name of the Vulnerable Software and Affected Versions HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress versions up to, and including, 2.5.35

Description The issue is related to DOM-Based Stored Cross-Site Scripting via the heading parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Recommendations For versions up to, and including, 2.5.35, consider disabling the heading parameter until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of arbitrary web script injection. Update to a version that includes the necessary input sanitization and output escaping fixes when available.