Video Share Vod Vulnerabilities

The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 2.7.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level per...

CVSS:

4.4

Affected:

up to 2.7.11

Fixed in:

2.7.12

Disclosed:

Feb 17, 2026

CVE-2025-13727 on NVD →

The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.6. This is due to missing or incorrect nonce validation on the adminExport() function. This makes it possible for unauthenticated attackers to update setting...

CVSS:

8.8

Affected:

up to 2.7.6

Fixed in:

2.7.7

Disclosed:

Aug 27, 2025

CVE-2025-7812 on NVD →

The Video Share VOD plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully...

CVSS:

6.1

Affected:

up to 2.7.9

Fixed in:

2.7.10

Disclosed:

Mar 12, 2025

CVE-2025-26583 on NVD →

The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_videos' shortcode in all versions up to, and including, 2.6.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it po...

CVSS:

6.4

Affected:

up to 2.6.31

Fixed in:

2.6.32

Disclosed:

Jan 17, 2025

CVE-2024-13393 on NVD →

The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_player_html' shortcode in all versions up to, and including, 2.6.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

CVSS:

6.4

Affected:

up to 2.6.30

Fixed in:

2.6.31

Disclosed:

Dec 17, 2024

CVE-2024-12449 on NVD →