CVE-2022-50949: Videos sync PDF stored XSS

CISO Take

This is a stored cross-site scripting flaw in the WordPress plugin 'Videos sync PDF' (v1.7.4), where the mov, pdf, mp4, webm, and ogg parameters in the options panel are not sanitized, letting an authenticated low-privilege user (e.g. contributor or author role) inject a payload such as an autofocus/onfocus handler that fires when an administrator views or edits video settings. There is no evidence this touches any genuine AI/ML pipeline, model, or agent framework — the 'ml_ui' tagging appears to be a categorization artifact rather than a real AI system dependency, so this should be treated as a routine WordPress plugin vulnerability rather than AI-specific threat intel. Exploitation requires low privileges but no user interaction beyond the admin opening the affected settings page, and CVSS 6.4 reflects confidentiality/integrity impact scoped to the admin session (scope changed) with no availability impact; there is no CISA KEV listing, no EPSS score available, and no Nuclei template, though a public exploit-db PoC (50874) exists. For a CISO, the practical action is: confirm whether 'Videos sync PDF' is actually installed anywhere in the estate (it is unlikely given it is not part of the tracked AI/ML package catalog), and if present, update to a patched version or remove the plugin, restrict who can hold contributor/author roles, and add WAF/CSP rules to block inline event-handler injection in admin-rendered fields.

Sources: NVD VulnCheck Exploit-DB

What is the risk?

Medium severity (CVSS 6.4) with low attack complexity and no user interaction, but privileges required (PR:L) meaningfully raises the bar — an attacker needs an existing authenticated account on the WordPress install. Scope is changed (S:C), meaning the payload executes in the higher-privileged administrator's browser context rather than the attacker's own, which is the real risk driver (session/cookie theft, admin account takeover). No KEV listing, no EPSS percentile, and no automated scanner (Nuclei) template exist, and there is no evidence of active exploitation beyond a public exploit-db PoC — so likelihood of opportunistic mass exploitation is low, but targeted abuse against sites with untrusted contributor accounts (e.g. multi-author blogs) is plausible.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privilege authenticated account (e.g. contributor/author) on a WordPress site running the vulnerable plugin.

Payload Injection

Attacker submits an unsanitized payload (e.g. autofocus/onfocus handler) into the mov, pdf, mp4, webm, or ogg parameters of the plugin's options panel.

Trigger via Victim Action

A site administrator opens or edits the video settings page, causing the browser to execute the stored malicious script in the admin's session context.

Impact

The attacker achieves session/cookie theft or unauthorized administrative actions (e.g. creating a rogue admin account), leading to full site compromise.

Initial Access

Attacker obtains or already holds a low-privilege authenticated account (e.g. contributor/author) on a WordPress site running the vulnerable plugin.

Payload Injection

Attacker submits an unsanitized payload (e.g. autofocus/onfocus handler) into the mov, pdf, mp4, webm, or ogg parameters of the plugin's options panel.

Trigger via Victim Action

A site administrator opens or edits the video settings page, causing the browser to execute the stored malicious script in the admin's session context.

Impact

The attacker achieves session/cookie theft or unauthorized administrative actions (e.g. creating a rogue admin account), leading to full site compromise.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Videos sync PDF	—	—	No patch

Do you use Videos sync PDF? You're affected.

How severe is it?

CVSS 3.1

6.4 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C Low

I Low

A None

What should I do?

1 step

1) Inventory WordPress installs for the 'Videos sync PDF' plugin (v1.7.4 or earlier) — no patched version is documented in the available advisory data, so if found, disable/remove the plugin until a fix is confirmed with the vendor (a-j-evolution.com). 2) Restrict contributor/author account issuance and review existing low-privilege accounts for suspicious recent edits to video/PDF fields. 3) Enforce output encoding/CSP (script-src restrictions, disallow inline event handlers) on wp-admin pages as defense in depth. 4) Monitor admin-panel access logs for unexpected edits to the plugin's mov/pdf/mp4/webm/ogg options fields as a detection signal.

How is it classified?

Code Execution Plugin

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2022-50949?

This is a stored cross-site scripting flaw in the WordPress plugin 'Videos sync PDF' (v1.7.4), where the mov, pdf, mp4, webm, and ogg parameters in the options panel are not sanitized, letting an authenticated low-privilege user (e.g. contributor or author role) inject a payload such as an autofocus/onfocus handler that fires when an administrator views or edits video settings. There is no evidence this touches any genuine AI/ML pipeline, model, or agent framework — the 'ml_ui' tagging appears to be a categorization artifact rather than a real AI system dependency, so this should be treated as a routine WordPress plugin vulnerability rather than AI-specific threat intel. Exploitation requires low privileges but no user interaction beyond the admin opening the affected settings page, and CVSS 6.4 reflects confidentiality/integrity impact scoped to the admin session (scope changed) with no availability impact; there is no CISA KEV listing, no EPSS score available, and no Nuclei template, though a public exploit-db PoC (50874) exists. For a CISO, the practical action is: confirm whether 'Videos sync PDF' is actually installed anywhere in the estate (it is unlikely given it is not part of the tracked AI/ML package catalog), and if present, update to a patched version or remove the plugin, restrict who can hold contributor/author roles, and add WAF/CSP rules to block inline event-handler injection in admin-rendered fields.

Is CVE-2022-50949 actively exploited?

No confirmed active exploitation of CVE-2022-50949 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-50949?

1) Inventory WordPress installs for the 'Videos sync PDF' plugin (v1.7.4 or earlier) — no patched version is documented in the available advisory data, so if found, disable/remove the plugin until a fix is confirmed with the vendor (a-j-evolution.com). 2) Restrict contributor/author account issuance and review existing low-privilege accounts for suspicious recent edits to video/PDF fields. 3) Enforce output encoding/CSP (script-src restrictions, disallow inline event handlers) on wp-admin pages as defense in depth. 4) Monitor admin-panel access logs for unexpected edits to the plugin's mov/pdf/mp4/webm/ogg options fields as a detection signal.

What systems are affected by CVE-2022-50949?

This vulnerability affects the following AI/ML architecture patterns: No genuine AI/ML architecture is affected — this is a standard WordPress admin UI (video/PDF embedding plugin) options panel, not an AI/ML pipeline, model server, or agent framework.

What is the CVSS score for CVE-2022-50949?

CVE-2022-50949 has a CVSS v3.1 base score of 6.4 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

No genuine AI/ML architecture is affected — this is a standard WordPress admin UI (video/PDF embedding plugin) options panel, not an AI/ML pipeline, model server, or agent framework

What are the technical details?

Original Advisory

WordPress Plugin Videos sync PDF 1.7.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by exploiting unsanitized mov, pdf, mp4, webm, and ogg parameters. Attackers can inject payloads like autofocus onfocus event handlers through the plugin options panel to execute arbitrary JavaScript when administrators view or edit video settings.

Exploitation Scenario

An attacker who has (or obtains) a low-privileged authenticated account on a WordPress site — e.g. via a compromised contributor credential or an open registration form — submits a crafted string such as `" autofocus onfocus=alert(document.cookie)//` into one of the plugin's media URL fields via the options panel. When a site administrator later opens the plugin's settings page to view or edit video configurations, the browser renders the injected attribute and executes the attacker's JavaScript in the admin's authenticated session, allowing cookie/session theft, silent creation of a new admin account, or further plugin/theme modification for persistence.

Weaknesses (CWE)

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.