SmartVideo <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call-to-Action Overlay Shortcode and Block Attributes
- ID
- WPSEC-2026-0344
- Plugin
- SmartVideo – Video Player and CDN (smartvideo)
- Affected
- from 2.4.0 before 2.4.5
- Remediation
- Update to 2.4.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- SmartVideo on WPSec AttackSurface
- Fix released
- Published
Description
The SmartVideo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the call-to-action overlay fields (the [smartvideo] shortcode 'overlay_text' and 'overlay_url' attributes and the block CTA text and link fields) in versions 2.4.0 to 2.4.4. The overlay setup data is JSON-encoded without hex-encoding ampersands before being placed in an HTML attribute, so HTML entities left by the earlier escaping are decoded by the browser and the player renders the result as live markup. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Only sites that have switched to the plugin's new player are affected; the legacy player is the default.
References
- https://wpsec.com/vuln/WPSEC-2026-0344/
- https://plugins.svn.wordpress.org/smartvideo/tags/2.4.5/
- https://wordpress.org/plugins/smartvideo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS