Audio And Video Player Vulnerabilities

The CP Media Player plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.3.3. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

(Wordfence)

Affected:

up to 1.3.3

Fixed in:

1.3.4

Disclosed:

Oct 5, 2026

CVE-2026-104678 on NVD →

The CP Media Player – Audio Player and Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.0. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in p...

CVSS:

7.2

(Wordfence)

Affected:

up to 1.3.0

Fixed in:

1.3.1

Disclosed:

Aug 25, 2026

CVE-2026-78281 on NVD →

The CP Media Player plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.3. This is due to missing or incorrect nonce validation on the admin_page function. This makes it possible for unauthenticated attackers to delete or duplicate existing audio or video players v...

CVSS:

4.3

(Wordfence)

Affected:

up to 1.1.3

Fixed in:

1.2.0

Disclosed:

Jan 29, 2024

CVE-2024-31941 on NVD →