{"id":"CVE-2026-54864","kind":"vulnerability","aliases":["CVE-2026-54864"],"related":[],"title":"Post Video Players WordPress plugin: unauthenticated XSS through versions 1.165","description":"Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.","summary":"The Post Video Players plugin for WordPress has a cross-site scripting flaw in versions up to and including 1.165. An unauthenticated visitor can inject script that runs in other users' browsers.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","post-video-players","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or in the plugin's main file header.","fix":"- Move the Post Video Players plugin to a version newer than `1.165`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-29T16:18:10+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:29:59+00:00","updated_at":"2026-10-29T16:29:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:29:59Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Post Video Players plugin to a version newer than `1.165`; the sources do not name the fixed version.","reach":"internet","title":"Post Video Players WordPress plugin: unauthenticated XSS through versions 1.165","impact":"medium","summary":"The Post Video Players plugin for WordPress has a cross-site scripting flaw in versions up to and including 1.165. An unauthenticated visitor can inject script that runs in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","post-video-players"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' and admins' browsers on the site","analyst_note":"Find the fixed plugin version and the vulnerable endpoint or parameter at the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-54864 or the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or in the plugin's main file header.\n- unknown for other checks; the sources do not say which pages or settings are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Post Video Players WordPress plugin at version 1.165 or older are the ones at risk. The sources do not say which plugin features or pages expose the flaw, so unknown for the exact path. Sites without this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4062,"output_tokens":565,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-54864':13A,16A '1.165':10A,43B,65C 'browser':55B 'cross':33B,57C 'cross-sit':32B 'cve':11A,14A 'flaw':36B 'includ':42B 'inject':48B 'packag':17B 'player':3A,21B,26B,64C 'plugin':5A,27B 'post':1A,19B,24B,62C 'post-video-play':18B 'run':51B 'script':35B,49B,59C 'site':34B,58C 'unauthent':6A,45B,56C 'user':54B 'version':9A,38B,66C 'video':2A,20B,25B,63C 'visitor':46B 'wordpress':4A,22B,29B 'xss':7A,60C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Post Video Players WordPress plugin at version 1.165 or older are the ones at risk. The sources do not say which plugin features or pages expose the flaw, so unknown for the exact path. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54864","severity":null,"published_at":"2026-10-29T16:18:10+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}