CVE-2022-50949
Stored XSS in Videos Sync PDF WordPress Plugin
Publication date: 2026-05-10
Last updated on: 2026-05-10
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WordPress Plugin Videos sync PDF version 1.7.4 contains a stored cross-site scripting (XSS) vulnerability.
This vulnerability allows authenticated attackers to inject malicious scripts by exploiting unsanitized parameters such as nom, pdf, mp4, webm, and ogg.
Attackers can inject payloads like autofocus onfocus event handlers through the plugin's options panel, which results in arbitrary JavaScript execution when administrators view or edit video settings.
How can this vulnerability impact me? :
This vulnerability can allow attackers with authenticated access to execute arbitrary JavaScript code in the context of the administrator's browser.
Such execution can lead to unauthorized actions, data theft, session hijacking, or further compromise of the WordPress site.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of malicious script injections in the parameters nom, pdf, mp4, webm, and ogg within the WordPress Plugin Videos sync PDF options panel.
Since the vulnerability involves stored cross-site scripting via these parameters, you can inspect the plugin's options panel inputs for suspicious payloads such as autofocus or onfocus event handlers.
Commands to detect this might include searching the WordPress database or plugin configuration files for these parameters containing suspicious JavaScript payloads.
- Use SQL queries to search the WordPress database for injected scripts in plugin options, e.g., `SELECT * FROM wp_options WHERE option_name LIKE '%videos_sync_pdf%' AND option_value LIKE '%onfocus%' OR option_value LIKE '%autofocus%';`
- Use grep or similar tools on the server to search plugin files or configuration for suspicious payloads, e.g., `grep -r --include='*.php' -E 'onfocus|autofocus' /path/to/wordpress/wp-content/plugins/videos-sync-pdf/`
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the WordPress Plugin Videos sync PDF to a version later than 1.7.4 where this vulnerability is fixed.
If an update is not immediately available, restrict access to the plugin's options panel to trusted administrators only to reduce the risk of exploitation.
Additionally, review and sanitize all inputs to the vulnerable parameters (nom, pdf, mp4, webm, ogg) to prevent injection of malicious scripts.
Consider implementing Web Application Firewall (WAF) rules to detect and block attempts to inject JavaScript payloads via these parameters.