CVE-2024-7727
HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vp_ajax_handler' ajax action in all versions up to, and including, 2.5.32. This makes it possible for unauthenticated attackers to call these functions to manipulate data.
| CWE | CWE-862 |
| Vendor | bplugins |
| Product | html5 video player – embed and play videos in custom player |
| Published | Sep 11, 2024 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for bplugins html5 video player – embed and play videos in custom player
Be the first to know when new medium vulnerabilities affecting bplugins html5 video player – embed and play videos in custom player are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
bplugins / HTML5 Video Player – Embed and Play Videos in Custom Player
0 ≤ 2.5.32
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/908df18e-7178-4d40-becb-86e1a714a7da?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/html5-video-player/trunk/inc/Model/ImportData.php#L4 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/html5-video-player/trunk/inc/Model/Ajax.php#L5 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3139559/
Credits
Lucio Sá