{"id":"CVE-2026-120364","kind":"vulnerability","aliases":["CVE-2026-120364"],"related":[],"title":"Vidplex WordPress theme: stored cross-site scripting through 1.0.3","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Untapwp Vidplex vidplex allows Stored XSS.This issue affects Vidplex: from n/a through 1.0.3.","summary":"Vidplex, a WordPress theme by Untapwp, fails to sanitize some input before rendering it in pages, so the injected content is saved and runs in visitors' browsers. An attacker who can submit that input can run script in the context of other users, including administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","vidplex","wordpress"],"not_affected_if":["other-theme","theme-not-installed"],"how_to_check":"- Check whether the Vidplex theme is installed and at what version (the sources name versions through `1.0.3`)\n- Confirm the installed version is above `1.0.3` in the theme's style.css header or the WordPress Appearance > Themes screen","fix":"- Vidplex: the sources state the affected range is through `1.0.3` but do not name a fixed version; unknown","status":"open","published_at":"2026-11-07T11:16:59+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","triaged_at":"2026-11-07T11:48:22+00:00","updated_at":"2026-11-07T11:48:22+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-07T11:48:22Z","model":"claude-haiku-5-5","output":{"fix":"- Vidplex: the sources state the affected range is through `1.0.3` but do not name a fixed version; unknown","reach":"internet","title":"Vidplex WordPress theme: stored cross-site scripting through 1.0.3","impact":"medium","summary":"Vidplex, a WordPress theme by Untapwp, fails to sanitize some input before rendering it in pages, so the injected content is saved and runs in visitors' browsers. An attacker who can submit that input can run script in the context of other users, including administrators.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","vidplex","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in other users' browsers, including administrators' sessions","analyst_note":"Confirm the fixed version and which input fields are stored unsanitized; the NVD entry gives only the range through 1.0.3.","how_to_check":"- Check whether the Vidplex theme is installed and at what version (the sources name versions through `1.0.3`)\n- Confirm the installed version is above `1.0.3` in the theme's style.css header or the WordPress Appearance > Themes screen","plain_action":"","needs_analyst":true,"not_affected_if":["theme-not-installed","other-theme"],"who_is_affected":"Sites running the Vidplex WordPress theme at version 1.0.3 or earlier. Exposure depends on whether untrusted visitors can submit content that is stored and later displayed to other users; sites not using this theme are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":4214,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120364':13A,16A '-2026':12A,15A '1.0.3':10A,94C 'administr':67B 'affect':89C 'allow':85C 'attack':51B 'browser':49B 'content':42B 'context':62B 'cross':6A,77C 'cross-sit':5A,76C 'cve':11A,14A 'fail':29B 'generat':75C 'host':20B 'improp':68C 'includ':66B 'inject':41B 'input':33B,56B,71C 'issu':88C 'n/a':92C 'neutral':69C 'page':38B,74C 'render':35B 'run':46B,58B 'sanit':31B 'save':44B 'script':8A,59B,79C 'self':19B 'self-host':18B 'site':7A,78C 'store':4A,86C 'submit':54B 'theme':3A,26B 'untapwp':28B,82C 'user':65B 'vidplex':1A,21B,23B,83C,84C,90C 'visitor':48B 'vulner':80C 'web':73C 'wordpress':2A,22B,25B 'xss.this':87C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Vidplex WordPress theme at version 1.0.3 or earlier. Exposure depends on whether untrusted visitors can submit content that is stored and later displayed to other users; sites not using this theme are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","selfhosted","vidplex","wordpress"],"campaign_type":null,"search_a":"'-120364':13A,16A '-2026':12A,15A '1.0.3':10A 'cross':6A 'cross-sit':5A 'cve':11A,14A 'script':8A 'site':7A 'store':4A 'theme':3A 'vidplex':1A 'wordpress':2A","search_b":"'administr':67B 'attack':51B 'browser':49B 'content':42B 'context':62B 'fail':29B 'host':20B 'includ':66B 'inject':41B 'input':33B,56B 'page':38B 'render':35B 'run':46B,58B 'sanit':31B 'save':44B 'script':59B 'self':19B 'self-host':18B 'submit':54B 'theme':26B 'untapwp':28B 'user':65B 'vidplex':21B,23B 'visitor':48B 'wordpress':22B,25B","search_c":"'1.0.3':94C 'affect':89C 'allow':85C 'cross':77C 'cross-sit':76C 'generat':75C 'improp':68C 'input':71C 'issu':88C 'n/a':92C 'neutral':69C 'page':74C 'script':79C 'site':78C 'store':86C 'untapwp':82C 'vidplex':83C,84C,90C 'vulner':80C 'web':73C 'xss.this':87C","first_public_at":"2026-11-07T11:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120364","severity":null,"published_at":"2026-11-07T11:16:59+00:00","modified_at":"2026-11-07T11:16:59+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","fetched_at":"2026-11-07T11:46:53+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}