Cp Media Player
Monthly
Unauthenticated cross-site scripting in the CP Media Player WordPress plugin (versions 1.3.0 and earlier, by Codepeople) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into visiting a crafted URL. Because the CVSS vector indicates a scope change (S:C), successful exploitation affects the victim's browser context beyond the plugin itself - enabling session hijacking, credential theft, or redirection to malicious infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Missing capability checks in the CP Media Player WordPress plugin before 1.3.4 let any authenticated user holding Contributor-level access create, modify, duplicate, and delete the site-wide media player configurations, and change at least one plugin setting that should be administrator-only. Exploitation requires a logged-in WordPress account with Contributor privileges on a site running the vulnerable plugin, with no user interaction required; publicly available exploit code exists, and there is no indication of active exploitation. This is an integrity-only, low-severity broken access control issue - our independent assessment scores it CVSS 3.1 2.7 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - and every signal points to low real-world priority rather than an urgent threat.
Unauthenticated cross-site scripting in the CP Media Player WordPress plugin (versions 1.3.0 and earlier, by Codepeople) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into visiting a crafted URL. Because the CVSS vector indicates a scope change (S:C), successful exploitation affects the victim's browser context beyond the plugin itself - enabling session hijacking, credential theft, or redirection to malicious infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Missing capability checks in the CP Media Player WordPress plugin before 1.3.4 let any authenticated user holding Contributor-level access create, modify, duplicate, and delete the site-wide media player configurations, and change at least one plugin setting that should be administrator-only. Exploitation requires a logged-in WordPress account with Contributor privileges on a site running the vulnerable plugin, with no user interaction required; publicly available exploit code exists, and there is no indication of active exploitation. This is an integrity-only, low-severity broken access control issue - our independent assessment scores it CVSS 3.1 2.7 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - and every signal points to low real-world priority rather than an urgent threat.