6.5Medium

CVE-2024-5522HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

HTML5 Video Player; bplugins html5_video_player Published: 2024-06-20 09:00 (2 years ago)

Description

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

Weakness (CWE): CWE-89

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
bplugins	html5_video_player	< 2.5.27
—	HTML5 Video Player	< 2.5.27

References and patches

https://wpscan.com/vulnerability/bc76ef95-a2a9-4185-8ed9-1059097a506a/ exploitvdb-entrytechnical-description

CVSS score

6.5Medium

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS (chance of exploitation in 30 days)

2.64%

higher than 86% of all CVEs

CISA assessment (SSVC)

Exploitation: poc
Automatable: no
Technical impact: partial

Timeline

ID reserved2024-05-30
Published2024-06-20 09:00
Reached IP-DB2026-10-24 23:55
Last updated2024-08-02 00:18

Assigned by (CNA): WPScan

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

8.8High

CVE-2026-125836 1 hour ago

WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability

Nicu Micle Simple JWT Login

Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.

Unscored

CVE-2026-124817 2 hours ago

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

Clockinator Lite

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.

Unscored

CVE-2026-76792 2 hours ago

User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

User Verification by PickPlugins

The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, …

Unscored

CVE-2026-124815 2 hours ago

Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

Clockinator Lite

The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injectio…

Unscored

CVE-2026-124814 2 hours ago

Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

Ultimate Addons for Elementor Forms

The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote …

Unscored

CVE-2026-124665 2 hours ago

Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR

Order Tracking

The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the …