HTML5 Video Player – Embed and Play Videos in Custom Player <= 2.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Caption Labels
- ID
- WPSEC-2026-2233
- Plugin
- HTML5 Video Player – embed fast, responsive videos with ease (html5-video-player)
- Affected
- all versions before 2.14.2
- Remediation
- Update to 2.14.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- HTML5 Video Player – Embed and Play Videos in Custom Player on WPSec AttackSurface
- Fix released
- Published
Description
The HTML5 Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the caption track labels and caption text shown by the video player in all versions up to, and including, 2.14.1. This is due to the bundled Plyr library writing caption track names into the player's captions and settings menus with innerHTML, and parsing Vimeo caption cues with innerHTML, without escaping. Caption track names can come from an HLS stream that the post author chooses as the video source, and the player block's stored attributes were not sanitized when a post was saved. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-2233/
- https://plugins.svn.wordpress.org/html5-video-player/tags/2.14.2/
- https://wordpress.org/plugins/html5-video-player/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS