CVE

CVE-2024-5522

6.5

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

Attack Vector

Network

Privileges Req.

None

User Interaction

None

html5 video playerhtml5_video_player

Updated Sep 18, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2024-5522 Scanner

CVE-2024-5522 scanner - SQL Injection vulnerability in WordPress HTML5 Video Player

Used 3.2k times · 5.9k assets checked · url

Scanner page →Run scanner

CVE history: html5 video player

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →