CVE-2024-7629

CVE-2024-7629 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Responsive video plugin for WordPress, affecting all versions up to and including 1.0. This flaw stems from insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access or higher to inject malicious web scripts into video settings. When a user accesses a page containing the injected script, it will execute, potentially leading to session hijacking or defacement. The vulnerability has a CVSS score of 5.4 (Medium), indicating a low attack complexity and requiring user interaction. While it allows for arbitrary script execution, the impact is limited to confidentiality and integrity, with no availability impact. Exploitation requires responsive videos to be enabled for posts. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules like Metasploit or Nuclei. The CVE has received minimal community discussion and media coverage, suggesting a low level of public awareness or concern at this time.