Minute Video

Minute Video has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Minute Video has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by Gilang - DJ. Minute Video is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Minute Video vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-6539

Voltax Video Player <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

Read the full analysis

Vulnerability Records

1 records
Minute Video banner
Latestv2.0.3

Minute Video

Minute

Author

Minute

0.0(0)
0/100
Last Updated
2026-10-14 (14d ago)
Active Installs
50+
Downloads
3,403
Requires WP
5.0.3+
Requires PHP
7.2+
Tested up to
WP 7.1.3
Created
2021-11-10 (5y ago)

The Minute Video plugin connects WordPress to Minute’s Online Video Platform (OVP). Use it to embed OVP videos and playlists in posts, sidebars, and theme templates, set featured video, and serve sendtonews embeds already in your content. Download the user guide (PDF) What you can do Configure OVP credentials under Settings > Minute Video Search and insert videos from the Video Library in the post editor (classic editor or Minute Video block) Insert playlists or shortcodes from the embed modal in widgets and the customizer Embed with the [voltax] shortcode (or legacy [mm-video] where already in use) Embed sendtonews content with the [sendtonews] shortcode or embed.sendtonews.com oEmbed URLs Set a featured video per post and render it with the MinuteMedia\Ovp\Player theme API Paste Minute Video URLs for oEmbed on *.minutemediaservices.com Serve AMP pages with Minute Platform and sendtonews amp-video-iframe output (legacy [mm-video] uses amp-minute-media-player) Account A Minute Platform OVP account is required for new Minute Video embeds. Contact sales@minutegroup.com for access. Developer reference wp-config constants VOLTAX_DEBUG — Enable admin/modal debug logging. Default false. DISABLE_VOLTAX_AMP_SWITCH — When true, disables automatic AMP switching for [voltax] and [sendtonews] embeds. DISABLE_S2N_AMP_SWITCH — Legacy STN constant; same behavior as DISABLE_VOLTAX_AMP_SWITCH. VOLTAX_ENABLE_OVERRIDE_PROPERTY — When true, shows Override Property on Featured Video, the Voltax block, and the Voltax widget for single-video selections. [voltax] property and organization attributes always work without this constant. Filters Featured Video metabox post types (default: post, page). Use voltax_featured_video_screens for new integrations. stnvideo_featured_video_screens is a legacy fallback used only when the voltax filter has no callbacks. voltax_featured_video_screens — ( $screens ) stnvideo_featured_video_screens — legacy fallback; ( $screens ) Embed playback and extension hooks: voltax_embed_playbackmethod — ( $playbackmethod, $content_id, $record, $options ) — autoplay, clicktoplay, or empty (omit override) voltax_amp_iframe_query_args — ( $args, $content_id ) — AMP iframe query args voltax_oembed_request_params — ( $params, $parsed, $url, $args ) — oEmbed request params voltax_oembed_parsed_url — ( $result, $query_params, $url ) — parsed source URL fields Voltax oEmbed also forwards allowlisted optional query params from the pasted URL (for example playbackmethod) when present; use the filters above to inject or override. Extra HTML attributes on player embed divs (standard/non-AMP only). Return a space-separated attribute string. voltax_extra_player_div_attributes — ( $attributes, $content_id, $post ) for [voltax] stnvideo_extra_player_div_attributes — ( $attributes, $player_type, $key, $cid, $post ) for [sendtonews]; $player_type is always single Legacy [mm-video] AMP. Use voltax_video_amp_attributes for new integrations. mm_video_amp_attributes is a legacy fallback used only when the voltax filter has no callbacks. voltax_video_amp_attributes — ( $attributes, $node ) mm_video_amp_attributes — legacy fallback; ( $attributes ) only voltax_amp_force_sanitizer_placeholder — ( $default, $record, $options ) voltax_amp_use_sanitizer_path — ( $default, $record, $options ) oEmbed: voltax_oembed_base — ( $default ) Voltax oEmbed service base URL (/oembed/player) Embeds and third-party scripts The plugin outputs shortcodes, player <script> tags, or AMP iframes. It does not bundle third-party player JavaScript. Voltax OVP ([voltax]) — player div + script: Script: https://players.voltaxservices.io/players/{organizationId}/{propertyId}/embed AMP iframe: https://mp.mmvideocdn.com/mini-player/amp/index.html Legacy Voltax ([mm-video]) — img placeholder swapped to script on the front end, or direct script embed: Script: https://vms-players.minutemediaservices.com/{playerId}.js (override with VOLTAX_EMBED_LEGACY_ENDPOINT) Front-end swap: plugin script public/js/voltax-video-player-public.js AMP: amp-minute-media-player via AMP sanitizer templates sendtonews / STN ([sendtonews]) — player div + script (or AMP iframe): float / single: //embed.sendtonews.com/player3/embedcode.js player (Smart Match float): //embed.sendtonews.com/player3/embedcode.js full / barker: //embed.sendtonews.com/player2/embedcode.php amp / amplist: https://amp.stnvideo.com/avi/ oEmbed providers STN: https://embed.sendtonews.com/services/oembed Voltax: *.minutemediaservices.com URLs resolved through /oembed/player (voltax_oembed_base, default https://videos-content.minutemediaservices.com). Editor uses preview_html; front-end uses html. Legacy editor blocks and widgets Block sendtonews/playerselector — preserved for existing posts; saved content remains [sendtonews ...] until replaced with voltax/video Widget sendtonews — preserved for existing sidebar/customizer instances; renders STN until replaced with Voltax fields on the same widget New block: voltax/video; new widget: voltax_video

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C