I am hosting a static website (no PHP etc., just HTML/JavaScript/CSS) with a security-conscious hoster that proactively removes vulnerable files. This is fine with me.
However, their last report states many instances of the following issue, with various files:
...
Sicherheitslücke vom Typ "XSS" in WordPress
/home/..../website/mediaelement-4.2.9/lang/uk.js
...
With the following explanation:
XSS vulnerability in the Flash fallback files in MediaElement
An XSS vulnerability was discovered in the Flash fallback files in MediaElement, a library that was included with WordPress. Because the Flash files are no longer needed for most use cases, they have been removed from WordPress.
My question is, how can a JavaScript file cause an XSS vulnerability in a flash fallback file?
Note: This is a media player, not a form processor.
Note 2: The mention of WordPress is another issue, since this is not a WordPress installation, but this is not part of the question here.