HTML5 Audio Player CVE-2026-62039

Exploitation requires an authenticated WordPress account with at least low privileges (PR:L - e.g., contributor/author able to submit content the plugin stores) on a site running Html5 Audio Player version ≤2.8.8, plus subsequent user interaction (UI:R): a victim such as an administrator or another user must load the page where the stored payload is rendered. The payload persists in plugin-stored data and fires when that content is viewed. Limiting factors that reduce real-world risk: the attacker cannot be fully anonymous (some authenticated access is needed), the injection only triggers when a victim views the affected content, and sites that restrict untrusted user accounts are substantially less exposed.

This is a moderate-severity Stored XSS (CWE-79) in the bPlugins Html5 Audio Player WordPress plugin, scored CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector indicates network reachability with low attack complexity, but it is NOT unauthenticated: PR:L means an attacker needs at least low-privilege authenticated access (typically a contributor/author-level account on the target WordPress site), and UI:R means a victim (e.g., an administrator or another user) must subsequently view the page containing the injected payload. The changed scope (S:C) reflects that the injected script executes in the victim's browser session rather than only against the vulnerable component, which is why confidentiality, integrity, and availability each carry a Low impact. No EPSS probability was provided in the input, there is no CISA KEV listing (not actively exploited per available data), and no public proof-of-concept is referenced - only a single Patchstack database advisory. On balance this is a real but routine WordPress plugin XSS: the authentication requirement (PR:L) and required user interaction (UI:R) meaningfully reduce real-world risk, making it a patch-in-normal-cycle issue rather than an emergency, absent evidence of active exploitation. Key missing data to note explicitly: no EPSS score and no POC status were supplied, so exploitation likelihood cannot be quantified from the input.

An attacker who holds a low-privilege authenticated account (e.g., contributor) on a WordPress site running Html5 Audio Player ≤2.8.8 injects a malicious script payload into a plugin-controlled input field that is stored and later rendered. When an administrator or other user views the affected page in the WordPress dashboard or front end, the script executes in their browser, potentially hijacking their session or performing actions on their behalf. No public exploit code is identified at time of analysis.