Audio Player Block CVE-2026-85415

Exploitation requires an authenticated account with the Contributor role or higher on the target WordPress site (PR:L), because Contributors can author posts containing the vulnerable Audio Player block. The specific trigger is a user-supplied link-target URL whose scheme is not validated, permitting a 'javascript:' (or similar) URI to be stored. Exploitation is NOT automatic: a second, more privileged user (administrator or editor) must later view the post and actively trigger/click the malicious link (UI:R) for the payload to fire in their session. Limiting factors: no unauthenticated access, dependence on a privileged victim's interaction, and affected only in versions 1.1.0 up to (not including) 1.6.3 - sites on 1.6.3+ are patched.

This is a genuine but moderate-severity stored XSS (CWE-79) in the Audio Player Block WordPress plugin, best treated as LOW-to-MEDIUM priority. Exploitation signals are weak: SSVC exploitation status is 'none', there is no EPSS score, no CISA KEV listing, and no public exploit code - so this is no public exploit identified at time of analysis. The primary limiter is that the attacker must already hold a Contributor (or higher) account, and a privileged victim (admin/editor) must later trigger the crafted link (UI:R), so this is not a mass-exploitable, drive-by flaw. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H = 6.8) is internally inconsistent with the description and overstated: the description says 'Contributor role and above,' which is PR:L not PR:H, and a javascript-scheme XSS firing in an admin's browser is a scope-changing (S:C) event with typical XSS impact of C:L/I:L/A:N - not the total C:H/I:H/A:H the vendor claims. SSVC 'Technical Impact: total' overstates it for the same reason. My independent recomputation lands at ~5.4. The realistic worst case is session-context script execution against an admin (cookie/nonce theft, forced admin actions), which is meaningful but requires a chain of preconditions.

An attacker registers or obtains a Contributor account on the target WordPress site and inserts an Audio Player block whose link target uses a 'javascript:' URL containing malicious script, since the plugin fails to validate the URL scheme. When an administrator or editor later reviews or previews that pending post and clicks/triggers the link, the script executes in their authenticated session, enabling actions such as nonce/cookie theft or creating a rogue admin. No public proof-of-concept is available and exploitation requires the privileged victim to interact with the link (UI:R).