hdwplayer vulnerabilities

Products

• com_hdwplayer 1
• hdw player 1
• hdw-player-video-player-video-gallery 1

Latest hdwplayer CVEs

Newest publication first

1. CVE-2020-37218 Joomla com_hdwplayer 4.2 SQL Injection via search.php

   Published 2026-05-13

   High·CVSS 8.8 EPSS 0.27%

   Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hdwplayersearch parameter. Attackers can submit POST requests with crafted SQL pa...

2. CVE-2023-49178 WordPress HDW Player Plugin (Video Player & Video Gallery) Plugin <= 5.0 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-12-15

   Medium·CVSS 6.1 EPSS 0.40%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mr. Hdwplayer HDW Player Plugin (Video Player & Video Gallery) allows Reflected XSS.This issue affects HDW Player Plugin (Video Player & Video Gallery): from n/a through 5.0.

3. CVE-2014-5180 HDW Player Plugin (Video Player & Video Gallery) <= 2.4.2 - Authenticated (Admin+) SQL Injection

   Published 2014-08-06

   Medium·CVSS 6.5 EPSS 2.3% Public exploit

   SQL injection vulnerability in the videos page in the HDW Player Plugin (hdw-player-video-player-video-gallery) 2.4.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the edit action to wp-admin/admin.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.