CVE-2025-26583
Published: 26 March 2025
Description
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Security Summary
CVE-2025-26583 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the videowhisper Video Share VOD WordPress plugin (video-share-vod). This issue affects all versions from n/a through 2.7.9.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Remote attackers require no privileges or authentication and can exploit it over the network with low attack complexity, though it demands user interaction such as clicking a malicious link. Exploitation enables limited impacts on confidentiality, integrity, and availability within a changed security scope, typically allowing execution of arbitrary scripts in the victim's browser context.
Patchstack provides details on the vulnerability and mitigation in its advisory at https://patchstack.com/database/Wordpress/Plugin/video-share-vod/vulnerability/wordpress-video-share-vod-plugin-2-6-32-reflected-cross-site-scripting-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Reflected XSS directly enables arbitrary JavaScript execution in the victim's browser (T1059.007) and is triggered via user interaction with a malicious link (T1204.001).