video.js

video.js

NPMNPM
NPMwww.npmjs.com
videojs.comvideojs.com
Releases496
Frequency1 week 2 days
Last Release
An HTML5 video player that supports HLS and DASH with a common API and skin.
Log in to subscribe

CVE History

CVEAffectedPublishedCVSS v3CVSS v2
CVE-2022-4786NVD↗
<= 4.5.05.4 MEDIUM—

The Video.js WordPress plugin through 4.5.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CVE-2021-23414NVD↗
< 7.14.36.5 MEDIUM4.3 MEDIUM

This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.