EUVD-2026-89823
GHSA-86x3-j3wx-4cmm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious payload in plugin-handled parameter
-
DeliveryDeliver crafted link to victim
-
ExploitVictim loads/clicks (UI:R)
-
ExecutionUnsanitized input reflected in page
-
PersistScript executes in victim browser origin
-
ImpactSteal session or perform admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the WordPress site to run the JW Player for WordPress plugin at version 2.3.11 or earlier, and requires victim user interaction (UI:R) - the target must click a crafted link or load an attacker-influenced page for the injected script to execute. No authentication is needed by the attacker (PR:N), so any remote actor can attempt delivery, but success depends on tricking a user into the interaction; there is no indication of a non-default configuration requirement beyond having the vulnerable plugin active. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, low-complexity, unauthenticated (PR:N) reflected/stored XSS whose only meaningful gate is required user interaction (UI:R) and whose scope change (S:C) reflects script executing in the victim's browser origin. The impacts are all Low (C:L/I:L/A:L), consistent with client-side script injection rather than server compromise - the 7.1 is driven largely by S:C plus the unauthenticated network reach, not by severe technical impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation; this is a patch-and-move-on issue rather than an emergency. There is no SSVC decision data in the input. Overall: a legitimate but moderate-priority web vulnerability whose real-world risk is bounded by the need to lure a victim into interacting with attacker-controlled input and by the confined, niche footprint of the affected plugin. No data conflicts are present, though the record does not specify whether the XSS is reflected or stored, which materially affects weaponization ease. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts a malicious URL or input that reaches the JW Player for WordPress plugin (<= 2.3.11) and gets reflected without proper output encoding. When a logged-in administrator or visitor clicks the link or loads the page, attacker-controlled JavaScript executes in their browser session, enabling session/cookie theft, admin-action forgery, or redirection. No public POC is referenced, but as a Patchstack-catalogued WordPress XSS the injection path is typically trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated cross-site scripting in JW Player for WordPress 2.3.11 and earlier allows remote attackers to inject script into a victim's browser when the victim interacts with a crafted link or attacker-influenced page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) reflects a network-reachable, low-complexity flaw that requires no attacker authentication but does require user interaction; successful exploitation runs script in the victim site's origin due to scope change. The issue is reported via Patchstack, and no public exploit or CISA KEV active-exploitation confirmation was provided at time of analysis.
RemediationAI
No exact fixed version is supplied in the provided data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jw-player-7-for-wp/vulnerability/wordpress-jw-player-for-wordpress-plugin-2-3-11-cross-site-scripting-xss-vulnerability?_s_id=cve and the vendor for an updated JW Player for WordPress release, then upgrade as soon as a patched version is available. If no patched release is available, deactivate and remove the plugin until an update is published; this eliminates exposure but disables JW Player embedding functionality on the site. As a compensating control, restrict untrusted users from creating or editing content that could inject script, and deploy a WAF rule to filter XSS payloads, though WAFs can be bypassed and do not correct the underlying CWE-79 issue. A Content Security Policy may reduce script execution in victims' browsers, with the trade-off of potentially breaking legitimate site scripts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the WordPress plugin JW Player for WordPress, identified by CPE cpe:2.3:a:ilghera:jw_player_for_wordpress:*:*:*:*:*:*:*:* and reported through Patchstack. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the plugin fails to properly sanitize or escape user-supplied input before reflecting it into HTML, leading to cross-site scripting. The CVSS vector PR:N means the attacker does not need to authenticate, while UI:R requires a victim to click a crafted link or load an attacker-influenced page; S:C indicates the injected script executes in the context of the vulnerable WordPress site's origin. The assessment describes the issue as reflected/stored XSS with limited confidentiality, integrity, and availability impact (C:L/I:L/A:L).
Know when Jw Player For Wordpress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network delivery (PR:N/AV:N) with required victim interaction (UI:R); script crosses into the browser origin (S:C) with limited client-side confidentiality/integrity/availability impact (all L).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.
Executive ViewAI
JW Player for WordPress versions 2.3.11 and earlier are affected by an unauthenticated cross-site scripting vulnerability that can allow attackers to inject malicious scripts into visitors' browsers, potentially leading to session hijacking or defacement of affected sites. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, but the high severity (CVSS 7.1) and scope change require immediate attention. Organizations using this plugin should prioritize interim mitigations to protect their WordPress sites and users.
Disable JW Player for WordPress plugin until a patch is available; implement web application firewall rules to filter malicious script injection; enforce Content Security Policy headers; educate users about phishing links; monitor vendor for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB