Really Simple Featured Video <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title in CIX Gallery Template
- ID
- WPSEC-2026-2406
- Plugin
- Really Simple Featured Video for Posts, Pages & WooCommerce Products (really-simple-featured-video)
- Affected
- from 0.15.0 before 1.2.0
- Remediation
- Update to 1.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Really Simple Featured Video on WPSec AttackSurface
- Fix released
- Published
Description
The Really Simple Featured Video for Posts, Pages & WooCommerce Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment titles in the CIX Woo Gallery Slider product gallery template in versions from 0.15.0 up to, and including, 1.1.0. This is due to attachment titles being placed unencoded into the lightbox data-caption attribute, which the lightbox renders as HTML. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts that execute when a user opens the lightbox on a product page, provided the CIX integration is active and the attacker's media is used in the product gallery.
References
- https://wpsec.com/vuln/WPSEC-2026-2406/
- https://plugins.svn.wordpress.org/really-simple-featured-video/tags/1.2.0/
- https://wordpress.org/plugins/really-simple-featured-video/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS