HTML5 Video Player – Embed and Play Videos in Custom Player <= 2.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Player Options
- ID
- WPSEC-2026-1841
- Plugin
- HTML5 Video Player – embed fast, responsive videos with ease (html5-video-player)
- Affected
- all versions before 2.14.1
- Remediation
- Update to 2.14.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-28
- Attack surface
- HTML5 Video Player – Embed and Play Videos in Custom Player on WPSec AttackSurface
- Fix released
- Published
Description
The HTML5 Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video block's player 'options' attribute and the playlist block's 'controls' attribute in all versions up to, and including, 2.14.0. The cause is insufficient input sanitization of the Plyr player configuration before it is passed to the front-end player. This covers provider SDK URLs, the download link, the ad tag URL, string 'controls' values and marker labels. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts or load external scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-1841/
- https://plugins.svn.wordpress.org/html5-video-player/tags/2.14.1/
- https://wordpress.org/plugins/html5-video-player/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS