Skip to content
Sign in
6.5 Medium

CVE-2026-119500 WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.1.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Exploitable remotely over the network, with an ordinary account and if a user takes an action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
Low
Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Affected products and versions

Product Affected versions Fixed in
Flash & HTML5 Video 2.14 earliest → 2.14.1 No fix stated

Other CVEs of Flash & HTML5 Video

The 3 CVEs of Flash & HTML5 Video →
CVE-2026-118097 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash &… 6.5 Medium CVE-2026-57323 Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions 5.8 Medium
Track this CVE