Cincopa video and media plug-in, ee7ba21e902a001f6add53b20020ff6f4ee03467

CVE, Research URL: ee7ba21e902a001f6add53b20020ff6f4ee03467
Home page URL: Security reports for Cincopa video and media plug-in
Application: Cincopa video and media plug-in
Published on: Aug 25, 2015
Research Description: Cincopa video and media plug-in [video-playlist-and-gallery-plugin] < 1.137 Cincopa video and media plug-in < 1.137 - Cross-Site Request Forgery to Stored Cross-Site Scripting The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery via the ‘cincopaafc’ parameter in versions before 1.137 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 1.137.
Status: vulnerable