WP Video Lightbox WordPress Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the WP Video Lightbox WordPress plugin, affecting versions prior to 1.9.5. The issue arises because the plugin does not properly escape the $_SERVER['REQUEST_URI'] parameter before including it in an attribute. This flaw could be exploited in older web browsers.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the WordPress admin options-general.php page with the wp_video_lightbox parameter. Include a script tag in the request URI to inject a script, such as an alert.

Remediation

Users are advised to update the WP Video Lightbox WordPress plugin to version 1.9.5 or later.