Description

Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T15:16:58.357Z",
  "pubdate": "2026-08-18T15:16:58.357Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Featured Video Plus plugin, affecting versions up to and including 2.3.3. This security flaw is classified as a Contributor-level Cross-Site Scripting vulnerability, allowing authenticated users with low-privileged roles, specifically Contributors, to inject malicious client-side scripts into web pages rendered to other application users.\nThe primary impact of this vulnerability involves the execution of arbitrary JavaScript within the context of a victim's browser session. Successful exploitation can lead to session hijacking, credential theft, unauthorized actions performed on behalf of other users, and potential defacement or manipulation of the affected WordPress site's content.\nThe affected system is the Featured Video Plus plugin across versions <= 2.3.3. The risk implication is moderate to high depending on the privileges of the targeted victims, such as administrators who may interact with the injected payload.\nThe attacker capabilities require authenticated access with at least Contributor-level privileges to create or modify content handled by the vulnerable plugin. Exploitation requirements mandate that a privileged user or administrator subsequently views the malicious input injected by the attacker.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and output encoding within the Featured Video Plus plugin <= 2.3.3. When processing user-supplied input intended for video embedding and feature rendering, the plugin fails to properly neutralize executable markup or JavaScript vectors supplied by users with Contributor privileges.\nThe vulnerable component resides within the input handling and rendering logic of the plugin, where parameters associated with featured videos are accepted, stored, and subsequently outputted in the DOM without adequate contextual output encoding or strict allow-listing of HTML attributes and tags.\nAttack flow and step-by-step exploitation occur as follows: First, an authenticated attacker with Contributor-level privileges crafts a malicious payload containing arbitrary JavaScript, such as an event handler or script tag disguised as video metadata or configuration parameters. Second, the attacker submits this payload through the vulnerable input interface provided by the plugin. Third, the application stores the unsanitized payload within the database without stripping or encoding the malicious script. Fourth, when an administrator or higher-privileged user views the post or administrative interface where the featured video is processed and rendered, the application reflects or outputs the stored payload directly into the HTML response. Finally, the victim's browser executes the malicious script within the security context of their active session, granting the attacker the ability to perform unauthorized actions or exfiltrate sensitive session tokens.\nAuthentication and privilege requirements dictate that the threat actor must possess valid credentials with at least Contributor-level access to the WordPress environment. Network exposure is standard web application exposure over HTTP/HTTPS. The payload behavior executes arbitrary JavaScript in the victim's browser context, leading to post-exploitation impacts such as administrative account compromise if an administrator views the crafted content."
}