What’s Vulnerable › Vulnerabilities

CVE-2014-1906

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-03-06 · updated 2026-06-17
• Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.

Affected products

• videowhisper Live Streaming Integration Plugin: 4.27, 4.27.3
• videowhisper Broadcast Live Video: through 4.27.4; 1.0.2, 2.0, 2.1, 2.2, 4.05, 4.07 (+2)

References

• http://packetstormsecurity.com/files/125454
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91477
• https://www.htbridge.com/advisory/HTB23199
• http://packetstormsecurity.com/files/125454
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91477
• https://www.htbridge.com/advisory/HTB23199

Get alerted when CVE-2014-1906 or the next vulnerability affects your stack