CVE-2014-1906
published 2014-03-06CVE-2014-1906: Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to…
PriorityP423medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
4.55%
90.4th percentile
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| videowhisper | live_streaming_integration_plugin | — | — |
| videowhisper | live_streaming_integration_plugin | — | — |
| videowhisper | videowhisper_live_streaming_integration | <= 4.27.4 | — |
| videowhisper | videowhisper_live_streaming_integration | — | — |
| videowhisper | videowhisper_live_streaming_integration | — | — |
| videowhisper | videowhisper_live_streaming_integration | — | — |
| videowhisper | videowhisper_live_streaming_integration | — | — |
| videowhisper | videowhisper_live_streaming_integration | — | — |
| videowhisper | videowhisper_live_streaming_integration | — | — |
| videowhisper | videowhisper_live_streaming_integration | — | — |
| videowhisper | videowhisper_live_streaming_integration | — | — |
| videowhisper | videowhisper_live_streaming_integration | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jf8j-j634-pfmg: Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4
ghsa_unreviewed·2022-05-17
CVE-2014-1906 [MEDIUM] CWE-79 GHSA-jf8j-j634-pfmg: Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.
GHSA
GHSA-f39g-97j7-v6v7: Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4
ghsa_unreviewed·2022-05-14·CVSS 4.3
CVE-2014-2297 [MEDIUM] CWE-79 GHSA-f39g-97j7-v6v7: Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap CVE-2014-1906.4.
No detection rules found.
No writeups or analysis indexed.
2014-03-06
Published