Executive brief
The Videos sync PDF plugin for WordPress, which is used to synchronize video content with PDF documents, contains a security flaw. An attacker with basic account access can inject malicious scripts into the plugin's settings. When an administrator later views or edits these settings, the script executes, potentially allowing the attacker to hijack the administrator's session or perform unauthorized actions on the website.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Videos sync PDF plugin version 1.7.4 for WordPress. The vulnerability stems from a failure to properly sanitize the 'nom', 'pdf', 'mp4', 'webm', and 'ogg' parameters within the plugin's options panel. An authenticated attacker can inject malicious JavaScript payloads, such as 'autofocus onfocus' event handlers, into these fields. The injected script is then executed in the context of any user (typically an administrator) who views or edits the affected video settings. This can lead to session hijacking or unauthorized administrative actions. A proof-of-concept exploit has been publicly disclosed.
Affected products
- A-J Evolution Videos sync PDF 1.7.4
Timeline
- 2022-04-13: disclosed: Vulnerability discovered and PoC created by UnD3sc0n0c1d0
- 2022-04-19: other: Exploit published on Exploit-DB
- 2026-05-10: advisory: NVD/VulnCheck advisory published