Plugin inspection:

JW Player for Flash & HTML5 Video

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Findings

  • Vulnerable to CSRF which allows an attacker to delete “players”: https://advisories.dxw.com/advisories/jw-player-for-flash-html5-video/
  • Uses eval() in JavaScript to parse JSON which may lead to XSS vulnerabilities
  • SQL is not escaped, but the only values put into SQL are constants

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

Contains a CSRF vulnerability.

Failure criteria

  • Execution of unprepared SQL statements
  • Unsafe request processing

Read more about our failure criteria.