CVE-2024-51940: 
WordPress vulnerability analysis and mitigation

A DOM-Based Cross-site Scripting (XSS) vulnerability has been identified in the WP Responsive Video WordPress plugin, affecting versions through 1.0. The vulnerability was discovered and reported on November 8, 2024, and assigned the identifier CVE-2024-51940. This security issue affects the sohelwpexpert WP Responsive Video plugin (Patchstack).

The vulnerability has been classified as a Cross-Site Scripting (XSS) issue, specifically of the DOM-Based variety. According to the CVSS 3.1 scoring system, it has received a base score of 6.5 (MEDIUM), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires contributor-level privileges or higher to exploit (Patchstack).

If exploited, this vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

The vulnerability requires contributor-level access to exploit, indicating that only authenticated users with specific privileges can potentially leverage this security issue. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

Currently, there is no official fix available for this vulnerability. The issue affects version 1.0 and earlier versions of the WP Responsive Video plugin (Patchstack).