CVE-2026-119365

MediumCVSS 6.5

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The Media Player Addons for Elementor (media-player-addons-for-elementor) plugin contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions from n/a through 1.1.10. This may allow stored XSS.

Risk Assessment

Stored XSS may allow an attacker to execute malicious script in the browsers of users visiting the site, potentially leading to session or data theft. This requires the ability to inject malicious content.

Recommendation

Update the Media Player Addons for Elementor plugin to a version later than 1.1.10 to fix the stored XSS vulnerability.

Other vulnerabilities in Media Player Addons for Elementor

CVE-2025-9203Medium
The Media Player Addons for Elementor plugin for WordPress version 1.0.5 is vulnerable to Stored Cross-Site Scripting via the 'subtitle_ssize', 'track_title', and 'track_artist_name' parameters. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widget for WP: from n/a through 1.1.10.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS