CVE-2026-78281: WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress CP Media Player pluginto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue is described as unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges. Exploitation still requires user interaction, as indicated by the UI:R vector.
Which installations are affected?
WordPress sites using CP Media Player version 1.3.0 or earlier are affected according to the available information.
What is the potential impact if exploitation succeeds?
The vulnerability can allow cross-site scripting, with low confidentiality, integrity, and availability impact in the published vector. The scope is changed, meaning the impact can extend beyond the vulnerable component's security authority.