CVE-2025-7963

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-7963 Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-7963

The Easy Waveform Player WordPress plugin (versions ≤ 1.2.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) in the shortcode_easywaveformplayer() function due to insufficient input sanitization and output escaping. Authenticated users with Contributor-level access or above can inject arbitra...

EUVD-2025-210826

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Easy Waveform Player plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Easy Waveform Player versions = 1.2.2...

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.13.1...

CVE-2026-19913

A flaw was found in the Kaltura HTML5 player mwEmbed / html5lib. An unauthenticated, remote attacker can exploit improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter, used for backend requests, accepts non-HTTP schemes such as file://. When an exception or error...

Linux Distros Unpatched Vulnerability : CVE-2026-19913

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in...

CVE-2026-78283

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78281

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

CVE-2026-78283 WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

EUVD-2026-66941

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78283

CVE-2026-78283 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Music Player for WooCommerce , affecting versions ≤ 1.8.9 . The flaw was discovered by daroo and is scored CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a ...

CVE-2026-78281 WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

EUVD-2026-66940

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

CVE-2026-78281

The WordPress plugin CP Media Player (versions

EUVD-2026-65615

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19913 CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19912 CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Music Player for WooCommerce versions = 1.8.9...