# HTML5 Video Player – Embed and Play Videos in Custom Player <= 2.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Player Options

- **ID:** WPSEC-2026-1841
- **Plugin:** HTML5 Video Player – embed fast, responsive videos with ease (`html5-video-player`), https://wordpress.org/plugins/html5-video-player/
- **Affected versions:** all versions before 2.14.1
- **Fixed in:** 2.14.1 (Update to 2.14.1 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/html5-video-player
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1841/

## Description

The HTML5 Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video block's player 'options' attribute and the playlist block's 'controls' attribute in all versions up to, and including, 2.14.0. The cause is insufficient input sanitization of the Plyr player configuration before it is passed to the front-end player. This covers provider SDK URLs, the download link, the ad tag URL, string 'controls' values and marker labels. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts or load external scripts in pages that will execute whenever a user accesses an injected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1841/
- https://plugins.svn.wordpress.org/html5-video-player/tags/2.14.1/
- https://wordpress.org/plugins/html5-video-player/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1841/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.