CVE-2026-118097: WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Q: Which versions should be treated as affected?

Flash & HTML5 Video versions through 2.14.0 are affected. The available data does not identify a fixed version.

Q: What access would an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and that user interaction is required. The issue is remotely reachable and has low confidentiality, integrity, and availability impact.

Q: Does exploitation affect only the vulnerable plugin's security boundary?

No. The CVSS vector indicates a changed scope (S:C), meaning the impact can extend beyond the vulnerable component's security authority.

Published Oct 29, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Flash & HTML5 Video plugin to a version that resolves this vulnerability.
Fixed in 2.14.1

Event History

Oct 29, 2026

CVE Published

via MITRE·02:39 PM

Data Sourced

via MITRE·02:39 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which versions should be treated as affected?

Flash & HTML5 Video versions through 2.14.0 are affected. The available data does not identify a fixed version.

What access would an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and that user interaction is required. The issue is remotely reachable and has low confidentiality, integrity, and availability impact.

Does exploitation affect only the vulnerable plugin's security boundary?