CVE-2026-93512: WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation requires user interaction, as reflected by the UI:R vector.

Q: Which installations are affected?

JW Player for WordPress versions 2.3.11 and earlier are identified as affected. The provided information does not state whether any particular WordPress configuration or plugin feature must be enabled.

Q: What is the potential impact?

Successful XSS can affect confidentiality, integrity, and availability at low impact levels. The scope may extend beyond the vulnerable plugin component, as indicated by the S:C vector.

Published Sep 30, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

Affected Software

1 affected component

JW Player JW Player for WordPress<=2.3.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress JW Player for WordPress Plugin to a version that resolves this vulnerability.
Fixed in 2.3.12

Event History

Sep 30, 2026

CVE Published

via MITRE·12:26 PM

Data Sourced

via MITRE·12:26 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation requires user interaction, as reflected by the UI:R vector.

Which installations are affected?