CVE-2026-119500mediumCWE-79

CVE-2026-119500: medium-severity vulnerability in bPlugins Flash & HTML5 Video

WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability

Published

Follow this CVE+ Monitor Flash & HTML5 Video

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected products
bPlugins · Flash & HTML5 Video
Related CVEs — bPlugins Flash & HTML5 Video

In the same product, most dangerous first.

CVE-2026-57323MEDIUMWordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-118097MEDIUMWordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%