CVE-2022-4578: The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a...

Summary

The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against ...

What to do

Update video_conferencing_with_zoom_project video_conferencing_with_zoom to version 4.0.10 or later.

Affected software

Vendor	Product	Affected versions
video_conferencing_with_zoom_project	video_conferencing_with_zoom	< 4.0.10 `cpe:2.3:a:video_conferencing_with_zoom_project:video_conferencing_with_zoom::::::wordpress::*`

Original advisory text

The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a...

The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

References

https://wpscan.com/vulnerability/fad16c68-9f14-4866-b241-40468fb71494 Exploit Third Party Advisory