WordPress Spider Video Player Plugin CVE-2014-8584 Cross Site Scripting Vulnerability

Bugtraq ID:	71007
Class:	Input Validation Error
CVE:	CVE-2014-8584
Remote:	Yes
Local:	No
Published:	Nov 04 2014 12:00AM
Updated:	Nov 04 2014 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Web Dorado Spider Video Player Project Web Dorado Spider Video Player 1.5.1 Web Dorado Spider Video Player Project Web Dorado Spider Video Player 1.4.9 Web Dorado Spider Video Player Project Web Dorado Spider Video Player 1.4.8 Web Dorado Spider Video Player Project Web Dorado Spider Video Player 1.4.7 Web Dorado Spider Video Player Project Web Dorado Spider Video Player 1.5
Not Vulnerable:	Web Dorado Spider Video Player Project Web Dorado Spider Video Player 1.5.2

WordPress Spider Video Player Plugin CVE-2014-8584 Cross Site Scripting Vulnerability

The Spider Video Player Plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Spider Video Player Plugin prior to 1.5.2 are vulnerable.

WordPress Spider Video Player Plugin CVE-2014-8584 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.