CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript

published April 22, 2020

CVSS
—
EPSS
1%
Percentile
58.9
In the wild
Unconfirmed
What it is

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00889 · 58.9th percentile
Published
2020-04-22T15:13Z
EPSS history
Timeline
  • 22 APR 15:13Z
    lazysizes through 5.2.0 allows execution of malicious JavaScript
    cvelistv5