Video List Manager Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thanhtungtnt Video List Manager allows Stored XSS. This issue affects Video List Manager: from n/a through 1.7.

Affected:

up to 1.7

Fix:

No patched version reported

Disclosed:

Jul 4, 2025

CVE-2025-52776 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager allows SQL Injection. This issue affects Video List Manager: from n/a through 1.7.

Affected:

up to 1.7

Fix:

No patched version reported

Disclosed:

Jul 4, 2025

CVE-2025-52831 on NVD →

The Video List Manager plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL querie...

CVSS:

7.5

Affected:

up to 1.7

Fix:

No patched version reported

Disclosed:

Jul 1, 2025

CVE-2025-52831 on NVD →

The Video List Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can success...

CVSS:

6.1

Affected:

up to 1.7

Fix:

No patched version reported

Disclosed:

Jun 26, 2025

CVE-2025-52776 on NVD →

[en] Missing Authorization vulnerability in thanhtungtnt Video List Manager allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Video List Manager: from n/a through 1.7.

Affected:

up to 1.7

Fix:

No patched version reported

Disclosed:

Jun 20, 2025

CVE-2025-49986 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager allows SQL Injection. This issue affects Video List Manager: from n/a through 1.7.

Affected:

up to 1.7

Fix:

No patched version reported

Disclosed:

Jun 20, 2025

CVE-2025-52821 on NVD →

The Video List Manager plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access an...

CVSS:

6.5

Affected:

up to 1.7

Fix:

No patched version reported

Disclosed:

Jun 19, 2025

CVE-2025-52821 on NVD →

The Video List Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.7

Fix:

No patched version reported

Disclosed:

Jun 19, 2025

CVE-2025-49986 on NVD →

[en] The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

Affected:

up to 1.7

Fix:

No patched version reported

Disclosed:

May 8, 2023

CVE-2023-1408 on NVD →

The Video List Manager plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrative privileges to...

CVSS:

7.2

Affected:

up to 1.7

Fix:

No patched version reported

Disclosed:

Apr 17, 2023

CVE-2023-1408 on NVD →