CVE-2026-124965: WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.16 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attack vector indicates that an attacker needs low-level privileges (PR:L). Exploitation also requires user interaction (UI:R).

Q: Which installations are affected?

The issue affects rtMedia for WordPress, BuddyPress and bbPress through version 4.7.16. The provided information does not identify a configuration-specific prerequisite or an unaffected default configuration.

Q: What is the likely impact if exploitation succeeds?

This is a stored cross-site scripting issue, meaning attacker-supplied script can be persisted and later executed when another user views the affected content. The supplied vector rates confidentiality, integrity, and availability impact as low, with scope changed.

Published Nov 13, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Stored XSS.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.16.

Affected Software

1 affected component

Rtcamp rtMedia for WordPress, BuddyPress and bbPress<=4.7.16

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.7.17

Event History

Nov 13, 2026

CVE Published

via MITRE·03:08 PM

Data Sourced

via MITRE·03:08 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attack vector indicates that an attacker needs low-level privileges (PR:L). Exploitation also requires user interaction (UI:R).

Which installations are affected?

The issue affects rtMedia for WordPress, BuddyPress and bbPress through version 4.7.16. The provided information does not identify a configuration-specific prerequisite or an unaffected default configuration.

What is the likely impact if exploitation succeeds?

This is a stored cross-site scripting issue, meaning attacker-supplied script can be persisted and later executed when another user views the affected content. The supplied vector rates confidentiality, integrity, and availability impact as low, with scope changed.

CVE-2026-124965: WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.16 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which installations are affected?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which installations are affected?

What is the likely impact if exploitation succeeds?