---
id: "CVE-2026-120364"
page: "https://infrastack.ai/live/CVE-2026-120364"
kind: "vulnerability"
aliases: ["CVE-2026-120364"]
title: "Vidplex WordPress theme: stored cross-site scripting through 1.0.3"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted", "vidplex", "wordpress"]
not_affected_if: ["other-theme", "theme-not-installed"]
published_at: "2026-11-07T11:16:59+00:00"
first_seen_at: "2026-11-07T11:46:53+00:00"
updated_at: "2026-11-07T11:48:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120364", "first_seen_at": "2026-11-07T11:46:53+00:00"}]
exploit_sources: []
---

# Vidplex WordPress theme: stored cross-site scripting through 1.0.3

Link for people: https://infrastack.ai/live/CVE-2026-120364 (this .md is for agents)

Vidplex, a WordPress theme by Untapwp, fails to sanitize some input before rendering it in pages, so the injected content is saved and runs in visitors' browsers. An attacker who can submit that input can run script in the context of other users, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Vidplex theme is installed and at what version (the sources name versions through `1.0.3`)
- Confirm the installed version is above `1.0.3` in the theme's style.css header or the WordPress Appearance > Themes screen

## Fix

- Vidplex: the sources state the affected range is through `1.0.3` but do not name a fixed version; unknown

## Timeline

- 2026-11-07T11:46:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120364

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Untapwp Vidplex vidplex allows Stored XSS.This issue affects Vidplex: from n/a through 1.0.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_