Media Player Addons For Elementor Media Player Widget For Wp
Monthly
Stored cross-site scripting in the bPlugins 'Media Player Addons for Elementor - Media Player widget for WP' WordPress plugin, affecting every version through 1.1.10, allows an authenticated user with low privileges to persist script payloads that execute in another user's browser session. Exploitation requires a valid WordPress account able to edit content that uses the Media Player widget (PR:L), and the payload only fires when a victim, typically a higher-privileged administrator or editor, renders the affected page (UI:R); the scope change reflects the payload running in the victim's security context. No CISA KEV entry or working exploit code is associated with this CVE in the available data, and the sole reference is the Patchstack vulnerability database entry; the trigger specifics are not described in the available sources.
Stored cross-site scripting in the bPlugins 'Media Player Addons for Elementor - Media Player widget for WP' WordPress plugin, affecting every version through 1.1.10, allows an authenticated user with low privileges to persist script payloads that execute in another user's browser session. Exploitation requires a valid WordPress account able to edit content that uses the Media Player widget (PR:L), and the payload only fires when a victim, typically a higher-privileged administrator or editor, renders the affected page (UI:R); the scope change reflects the payload running in the victim's security context. No CISA KEV entry or working exploit code is associated with this CVE in the available data, and the sole reference is the Patchstack vulnerability database entry; the trigger specifics are not described in the available sources.