Video Conferencing With Zoom Api Vulnerabilities

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.6.8. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbit...

CVSS:

6.4

Affected:

up to 4.6.8

Fix:

No patched version reported

Disclosed:

Aug 18, 2026

CVE-2026-66641 on NVD →

The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain the site's Zoom SDK API...

CVSS:

5.3

Affected:

up to 4.6.7

Fixed in:

4.6.8

Disclosed:

Jun 15, 2026

CVE-2026-6964 on NVD →

The Video Conferencing with Zoom plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 4.6.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 4.6.6

Fixed in:

4.6.6

Disclosed:

Feb 19, 2026

CVE-2026-1368 on NVD →

The Video Conferencing with Zoom plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.6.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 4.6.6

Fixed in:

4.6.7

Disclosed:

Feb 15, 2026

CVE-2026-39653 on NVD →

[en] URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Deepen Bajracharya Video Conferencing with Zoom.This issue affects Video Conferencing with Zoom: from n/a through 4.4.4.

Affected:

up to 4.4.5

Fixed in:

4.4.5

Disclosed:

Apr 29, 2024

CVE-2024-33584 on NVD →

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 4.4.4. This is due to insufficient validation on a redirect url. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick...

CVSS:

6.1

Affected:

up to 4.4.4

Fixed in:

4.4.5

Disclosed:

Apr 25, 2024

CVE-2024-33584 on NVD →

[en] The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the get_assign_host_id AJAX action. This makes it possible for authenticated attackers, with subscriber access or higher, to enumerate usernames, emails and IDs of a...

Affected:

up to 4.4.6

Fixed in:

4.4.6

Disclosed:

Apr 9, 2024

CVE-2024-2033 on NVD →

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the get_assign_host_id AJAX action. This makes it possible for authenticated attackers, with subscriber access or higher, to enumerate usernames, emails and IDs of all us...

CVSS:

4.3

Affected:

up to 4.4.5

Fixed in:

4.4.6

Disclosed:

Mar 22, 2024

CVE-2024-2033 on NVD →

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoom_recordings_by_meeting' shortcode in all versions up to, and including, 4.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authen...

CVSS:

6.4

Affected:

up to 4.4.4

Fixed in:

4.4.5

Disclosed:

Mar 12, 2024

CVE-2024-2031 on NVD →

[en] The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoom_recordings_by_meeting' shortcode in all versions up to, and including, 4.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for a...

Affected:

up to 4.4.5

Fixed in:

4.4.5

Disclosed:

Mar 12, 2024

CVE-2024-2031 on NVD →

[en] The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and passwor...

Affected:

up to 4.3.0

Fixed in:

4.3.0

Disclosed:

Jul 26, 2023

CVE-2023-3947 on NVD →

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and password.

CVSS:

3.7

Affected:

up to 4.2.1

Fixed in:

4.2.2

Disclosed:

Jul 25, 2023

CVE-2023-3947 on NVD →

[en] The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege...

Affected:

up to 4.0.10

Fixed in:

4.0.10

Disclosed:

Jan 16, 2023

CVE-2022-4578 on NVD →

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode in versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject...

CVSS:

6.4

Affected:

up to 4.0.9

Fixed in:

4.0.10

Disclosed:

Dec 29, 2022

CVE-2022-4578 on NVD →

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 3.9.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

CVSS:

6.1

Affected:

up to 3.9.2

Fixed in:

3.9.3

Disclosed:

May 31, 2022

Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress Video Conferencing with Zoom plugin (versions <= 3.9.2). Update the WordPress Video Conferencing with Zoom plugin to the latest available version (at least 3.9.3).

Affected:

up to 3.9.2

Fixed in:

3.9.2

Disclosed:

May 31, 2022

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 3.9.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

Affected:

up to 3.9.3

Fixed in:

3.9.3

Disclosed:

May 31, 2022

[en] The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog

Affected:

up to 3.8.17

Fixed in:

3.8.17

Disclosed:

Mar 7, 2022

CVE-2022-0384 on NVD →

The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog

CVSS:

4.3

Affected:

up to 3.8.17

Fixed in:

3.8.17

Disclosed:

Feb 14, 2022

CVE-2022-0384 on NVD →

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘host_id’ parameter in versions before 3.8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execu...

CVSS:

6.1

Affected:

up to 3.8.16

Fixed in:

3.8.16

Disclosed:

Nov 30, 2021

Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress Video Conferencing with Zoom plugin (versions <= 3.8.15).

Affected:

up to 3.8.16

Fixed in:

3.8.16

Disclosed:

Nov 30, 2021

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘host_id’ parameter in versions before 3.8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execu...

Affected:

up to 3.8.16

Fixed in:

3.8.16

Disclosed:

Nov 30, 2021

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Affected:

up to 3.9.3

Fixed in:

3.9.3

The plugin does not sanitise and escape user data before outputting it back in attributes in some admin pages, leading to Reflected Cross-Site Scripting issues

Affected:

up to 3.8.16

Fixed in:

3.8.16