CVE-2015-6535 YouTube Embed <= 3.3.2 - Cross-Site Scripting
LowCVSS 3.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field (youtube_embed_name parameter).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress youtube-embed(WordPress) | < 3.3.3 | 3.3.3 |
| youtube embed project youtube embed | <= 3.3.2 | No fix listed |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- packetstormsecurity.com
- 20150826 CVE-2015-6535: Stored XSS in YouTube Embed (WordPress plugin) allows admins to compromise super admins mailing-list
- wordpress.org patch vendor-advisory
- wpvulndb.com