Vulnerability Details CVE-2014-1906
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.011
EPSS Ranking 76.8%
CVSS Severity
CVSS v2 Score 4.3
References
Products affected by CVE-2014-1906
-
cpe:2.3:a:videowhisper:live_streaming_integration_plugin:1.0.2
-
cpe:2.3:a:videowhisper:live_streaming_integration_plugin:2.0
-
cpe:2.3:a:videowhisper:live_streaming_integration_plugin:2.1
-
cpe:2.3:a:videowhisper:live_streaming_integration_plugin:2.2
-
cpe:2.3:a:videowhisper:live_streaming_integration_plugin:4.05
-
cpe:2.3:a:videowhisper:live_streaming_integration_plugin:4.07
-
cpe:2.3:a:videowhisper:live_streaming_integration_plugin:4.25
-
cpe:2.3:a:videowhisper:live_streaming_integration_plugin:4.25.3
-
cpe:2.3:a:videowhisper:live_streaming_integration_plugin:4.27
-
cpe:2.3:a:videowhisper:live_streaming_integration_plugin:4.27.3