CVE Catalog
CVE-2026-54864
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk0.18%
8th percentile - higher than 8% of all known CVEs
Summary
The Post Video Players WordPress plugin in versions up to 1.165 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script that executes in the victim's browser.
Risk Assessment
Session hijacking, data theft, or content manipulation is possible. The risk affects all sites running the vulnerable plugin version.
Recommendation
Update the Post Video Players plugin to a version above 1.165. Until then, consider deactivating the plugin or deploying WAF filters.
Other vulnerabilities in Post Video Players
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS