CVE-2026-78281

HighCVSS 7.1

Published: 27/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Unauthenticated XSS vulnerability in CP Media Player versions up to 1.3.0. An attacker can inject malicious script that executes in the victim's browser.

Risk Assessment

Risk of session theft, account takeover, or malware distribution.

Recommendation

Update the CP Media Player plugin to the latest version. Additionally, apply input filtering and output encoding.

Other vulnerabilities in CP Media Player

CVE-2026-104678Low
The CP Media Player WordPress plugin before version 1.3.4 does not perform a capability check on its settings-page handler, allowing users with Contributor-level access to create, modify, duplicate, and delete site-wide media player configurations and change an option that should require administrator access.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS