CVE-2026-78283

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78281

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

CVE-2026-78283

CVE-2026-78283 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Music Player for WooCommerce , affecting versions ≤ 1.8.9 . The flaw was discovered by daroo and is scored CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a ...

CVE-2026-78283 WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

EUVD-2026-66941

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78283 WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78281

The WordPress plugin CP Media Player (versions

CVE-2026-78281 WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

EUVD-2026-66940

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

CVE-2026-78281 WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

PT-2026-82460

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

PT-2026-82459

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

CVE-2026-78283: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78281: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

CVE-2026-19913 CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

EUVD-2026-65615

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19913 CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19912 CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

CVE-2026-19912 CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

WordPress Podcast Player plugin < 8.3.1 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by ApogeeBytes in WordPress Plugin Podcast Player versions 8.3.1...