Input validation vulnerability in Dewplayer *

The WordPress Dewplayer and Advanced Dewplayer plugins versions 1.2 and below, respectively, are vulnerable to content spoofing or injection. This means that if an attacker can successfully convince someone to click on a link, they can inject malicious content into legitimate content because the plugins do not properly sanitize the data from their ‘mp3’, ‘file’, ‘sound’, and ‘son’ parameters.