{"id":"CVE-2026-119365","kind":"vulnerability","aliases":["CVE-2026-119365"],"related":[],"title":"WordPress Media Player Addons for Elementor: stored XSS through versions 1.1.10","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widget for WP: from n/a through 1.1.10.","summary":"The Media Player Addons for Elementor plugin for WordPress, by bPlugins, has a stored cross-site scripting flaw in its Media Player widget. An attacker who can store content in the widget can run JavaScript in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","media-player-addons-for-elementor","other","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated-past-1.1.10"],"how_to_check":"- Check whether the `media-player-addons-for-elementor` plugin is installed and its version in the WordPress admin plugin list\n- Confirm whether the installed version is `1.1.10` or older","fix":"- Media Player Addons for Elementor: update to a version later than `1.1.10` (fixed version not stated in the sources)","status":"open","published_at":"2026-10-30T17:17:18+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:07+00:00","updated_at":"2026-10-30T17:32:07+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T17:32:07Z","model":"claude-haiku-5-5","output":{"fix":"- Media Player Addons for Elementor: update to a version later than `1.1.10` (fixed version not stated in the sources)","reach":"internet","title":"WordPress Media Player Addons for Elementor: stored XSS through versions 1.1.10","impact":"medium","summary":"The Media Player Addons for Elementor plugin for WordPress, by bPlugins, has a stored cross-site scripting flaw in its Media Player widget. An attacker who can store content in the widget can run JavaScript in other visitors' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","elementor","media-player-addons-for-elementor"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, stealing sessions","analyst_note":"Confirm the fixed version and whether the stored input needs authentication, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119365 and the plugin vendor changelog.","how_to_check":"- Check whether the `media-player-addons-for-elementor` plugin is installed and its version in the WordPress admin plugin list\n- Confirm whether the installed version is `1.1.10` or older\n- unknown whether a specific configuration is required to trigger it","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated-past-1.1.10"],"who_is_affected":"Sites running the Media Player Addons for Elementor plugin version 1.1.10 or older with the Media Player widget in use. The sources do not say whether an account is required to store the malicious content, so the exposure of contributor-level or anonymous input is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000739,"input_tokens":4158,"output_tokens":647,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119365':14A,17A '-2026':13A,16A '1.1.10':11A,116C 'addon':4A,22B,30B,84C,95C,105C 'affect':102C 'allow':98C 'attack':52B 'bplugin':37B,81C 'browser':66B 'content':56B 'cross':42B,76C 'cross-sit':41B,75C 'cve':12A,15A 'elementor':6A,18B,24B,32B,86C,97C,107C 'flaw':45B 'generat':74C 'improp':67C 'input':70C 'issu':101C 'javascript':62B 'media':2A,20B,28B,48B,82C,87C,93C,103C,108C 'media-player-addons-for-elementor':19B,92C 'n/a':114C 'neutral':68C 'page':73C 'player':3A,21B,29B,49B,83C,88C,94C,104C,109C 'plugin':33B 'run':61B 'script':44B,78C 'site':43B,77C 'store':7A,40B,55B,99C 'version':10A 'visitor':65B 'vulner':79C 'web':72C 'widget':50B,59B,89C,110C 'wordpress':1A,26B,35B 'wp':91C,112C 'xss':8A 'xss.this':100C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Media Player Addons for Elementor plugin version 1.1.10 or older with the Media Player widget in use. The sources do not say whether an account is required to store the malicious content, so the exposure of contributor-level or anonymous input is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119365","severity":null,"published_at":"2026-10-30T17:17:18+00:00","modified_at":"2026-10-30T17:18:40+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}