CVE-2024-32537

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-32537", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2024-04-15T09:13:46.576Z", "datePublished": "2026-03-20T09:09:46.014Z", "dateUpdated": "2026-04-28T16:09:36.808Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "flash-video-player", "product": "Flash Video Player", "vendor": "joshuae1974", "versions": [{"lessThanOrEqual": "5.0.4", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Dimas Maulana | Patchstack Bug Bounty Program"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-Site request forgery (CSRF) vulnerability in joshuae1974 Flash Video Player allows Cross Site Request Forgery.<p>This issue affects Flash Video Player: from n/a through 5.0.4.</p>"}], "value": "Cross-Site request forgery (CSRF) vulnerability in joshuae1974 Flash Video Player allows Cross Site Request Forgery.This issue affects Flash Video Player: from n/a through 5.0.4."}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site request forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:09:36.808Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/flash-video-player/vulnerability/wordpress-flash-video-player-plugin-5-0-4-csrf-to-xss-vulnerability?_s_id=cve"}], "source": {"discovery": "EXTERNAL"}, "tags": ["x_open-source", "unsupported-when-assigned"], "title": "WordPress Flash Video Player plugin <= 5.0.4 - CSRF to XSS vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T14:06:23.838446Z", "id": "CVE-2024-32537", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T14:07:19.501Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32537", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T14:06:23.838446Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T14:07:06.238Z"}}], "cna": {"tags": ["x_open-source", "unsupported-when-assigned"], "title": "WordPress Flash Video Player plugin <= 5.0.4 - CSRF to XSS vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Dimas Maulana | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "joshuae1974", "product": "Flash Video Player", "versions": [{"status": "affected", "version": "n/a", "versionType": "custom", "lessThanOrEqual": "5.0.4"}], "packageName": "flash-video-player", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/flash-video-player/vulnerability/wordpress-flash-video-player-plugin-5-0-4-csrf-to-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Cross-Site request forgery (CSRF) vulnerability in joshuae1974 Flash Video Player allows Cross Site Request Forgery.This issue affects Flash Video Player: from n/a through 5.0.4.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site request forgery (CSRF) vulnerability in joshuae1974 Flash Video Player allows Cross Site Request Forgery.<p>This issue affects Flash Video Player: from n/a through 5.0.4.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site request forgery (CSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-20T09:09:46.014Z"}}}, "cveMetadata": {"cveId": "CVE-2024-32537", "state": "PUBLISHED", "dateUpdated": "2026-03-20T14:07:19.501Z", "dateReserved": "2024-04-15T09:13:46.576Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-20T09:09:46.014Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "flash-video-player", "product": "Flash Video Player", "vendor": "joshuae1974", "versions": [{"lessThanOrEqual": "5.0.4", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [{"sourceIdentifier": "audit@patchstack.com", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "Cross-Site request forgery (CSRF) vulnerability in joshuae1974 Flash Video Player allows Cross Site Request Forgery.This issue affects Flash Video Player: from n/a through 5.0.4."}, {"lang": "es", "value": "Falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) vulnerabilidad en joshuae1974 Flash Video Player permite falsificaci\u00f3n de petici\u00f3n en sitios cruzados. Este problema afecta a Flash Video Player: desde n/a hasta 5.0.4."}], "id": "CVE-2024-32537", "lastModified": "2026-06-17T07:29:48.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.7, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-32537", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T14:06:23.838446Z", "version": "2.0.3"}}]}, "published": "2026-03-20T10:16:18.073", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/flash-video-player/vulnerability/wordpress-flash-video-player-plugin-5-0-4-csrf-to-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.0.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Flash Video Player", "source": "cna", "vendor": "joshuae1974"}, "product": "flash_video_player", "vendor": "joshuae1974"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-20T10:50:38.182128+00:00", "value": {"mitigation_remediation": ["Update Flash Video Player to a version newer than 5.0.4 once available", "If an update is not yet released, consider temporarily disabling or removing the plugin until a patch is available", "Restrict plugin usage permissions to administrators only"], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "The plugin joshuae1974 Flash Video Player for WordPress is affected in all released versions up to and including 5.0.4; newer releases are not reported to be vulnerable.", "description_and_impact": "Cross\u2011Site Request Forgery (CWE\u2011352) in the WordPress Flash Video Player plugin allows an attacker to perform actions on the website on behalf of an authenticated user, potentially enabling the injection or modification of site content that could lead to cross\u2011site scripting or other integrity\u2011related issues.", "risk_and_exploitability": "The CVSS base score of 7.1 indicates high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the lack of exploit probability data does not reduce the risk to WordPress sites running the affected plugin. The attack vector is web\u2011based, requiring the victim to be an authenticated user or to be lured into visiting a crafted URL that triggers the forged request, potentially granting the attacker the privileges of that user and allowing malicious content injection."}}}}, "created": "2026-03-20T11:05:23.334940+00:00", "updated": "2026-03-20T16:27:32.279196+00:00", "vendors": ["joshuae1974", "joshuae1974$PRODUCT$flash_video_player", "wordpress", "wordpress$PRODUCT$wordpress"]}