CVE-2026-93512

HighCVSS 7.1

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The JW Player for WordPress plugin versions 2.3.11 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

Risk Assessment

Risk of session theft, cookie theft, or other user data compromise, as well as account takeover.

Recommendation

Update the JW Player for WordPress plugin to the latest version that includes the fix.

Other vulnerabilities in JW Player for WordPress

CVE-2026-39614Medium
The JW Player for WordPress plugin lacks authorization, allowing an attacker to exploit incorrectly configured access control security levels.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS