CVE-2026-6439
The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping in the videozen_conf() function. The ‘lang’ POST parameter is stored directly via update_option() without any sanitization, and later echoed inside a
More information : https://plugins.trac.wordpress.org/browser/videozen/tags/1.0.1/videozen-conf.php#L24
