Media Player Addons for Elementor CVE-2026-119365

Exploitation requires an authenticated WordPress account with at least low-privilege access sufficient to edit content using the Media Player widget (PR:L), and the stored payload only triggers when another user - typically a higher-privileged administrator or editor - views the affected page (UI:R). It applies to the Media Player Addons for Elementor - Media Player widget plugin from unspecified early versions through 1.1.10, and implicitly requires the Elementor page builder environment in which this add-on operates. Limiting factors: the attacker cannot act without a valid authenticated account, and no automatic/remote-unauthenticated path exists; the impact depends on a privileged victim rendering the injected content.

This is a moderate-severity stored Cross-Site Scripting flaw (CVSS 6.5) in the bPlugins 'Media Player Addons for Elementor' WordPress plugin, affecting all versions up to and including 1.1.10. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable but not fully unauthenticated issue: PR:L means an attacker needs at least low-privilege authenticated access (typically a contributor/author-level account able to use the widget), and UI:R means a victim must view the page for the stored payload to fire. The scope change (S:C) reflects that the injected script executes in the browser of another user (e.g. an administrator), which is why Patchstack treats this as more than a self-XSS. No CISA KEV listing and no EPSS score are present in the supplied data, and no proof-of-concept or exploit reference is provided - only a Patchstack database advisory link. The vuln.today decision label is 'this_month', indicating a routine-but-not-emergency priority. On balance this is a real but low-to-moderate priority issue: the dual authentication-plus-interaction requirement and the limited (Low) confidentiality/integrity/availability impacts constrain real-world risk, and there is no evidence of active exploitation. Note that the A:L (availability) impact is atypical for stored XSS and appears to follow Patchstack's scoring convention rather than a described availability effect - treat it with caution.

A user holding a low-privilege authenticated role (such as a contributor or author) that can configure the Media Player widget injects a malicious script into a widget field, which is stored unsanitized. When a higher-privileged user such as an administrator later views the affected page or post, the script executes in their authenticated browser session, potentially enabling account takeover or privileged actions. No public exploit identified at time of analysis; exploitation requires both the attacker's authenticated access and victim interaction.