CVE-2026-119500
📛 CVE Title
WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.1.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Patchstack
- CVSS severity
- MEDIUM
- CVSS score
- 6.5 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L- Effective score
- 6.5 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-79 - Reserved
- 2026-10-30
- Published
- 2026-11-07 10:11 UTC
- Last updated
- 2026-11-07 18:06 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119500.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-11-07 10:17:08 UTC
- NVD last modified
- 2026-11-07 18:17:15 UTC
- NVD CVSS v3.1
- 6.5 / 10 MEDIUM source: audit@patchstack.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L- Exploitability subscore
- 2.3 / 10
- Impact subscore
- 3.7 / 10
NVD / KEV / EPSS data refreshed 2026-11-08 10:03 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-119104
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| bPlugins | Flash & HTML5 Video |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
Remediations (10)
-
web:crimsondesert.pearlabyss.com
Here are the fixes and improvements that have been added this patch . The patch is rolling out across all platforms. Please refer to the Update section below to see the state of the patch for each platform. XBOX: Patch available at a later time (in-progress) Epic Games Store: Patch available at a ...
2026-11-08 11:41 UTC -
web:epatch.pa.gov
Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...
2026-11-08 11:41 UTC -
web:learn.microsoft.com
Find information on known issues and the status of the Windows 11, version 26H2 availability. For immediate help with Windows update issues, open the Get Help app if you are using a Windows device, or go to support.microsoft.com. Follow @WindowsUpdate on X for Windows release health updates. If you are an IT administrator and want to programmatically get information from this page, use the ...
2026-11-08 11:41 UTC -
web:sec.cloudapps.cisco.com
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching ...
2026-11-08 11:41 UTC -
web:support.esri.com
This patch deals specifically with the issues listed below under Issues addressed with this patch . As part of the patch installation, the ArcGIS Server service is stopped and restarted. The restart may take several minutes depending on the number of services published on the ArcGIS Server site. This patch can be uninstalled as outlined in the Uninstalling this patch on Windows and Uninstalling ...
2026-11-08 11:41 UTC -
web:trust.barracuda.com
Patches If a patch has not been automatically applied, customers should manually apply the appropriate patch as soon as possible. If customers have turned off automatic patching, Barracuda recommends setting devices to automatically receive patches. Guidance on how to manually apply the patch or update firmware can be found on Barracuda Campus.
2026-11-08 11:41 UTC -
web:windowsforum.com
Microsoft's October 2026 Patch Tuesday is the largest it has ever released. Counts vary by source, but every source agrees on what to do first. Patch the actively exploited Windows Shell zero-day before anything else. Then look at the .NET Framework flaw that can bypass application control. After that, check your support calendar, because several Windows editions got their last security update ...
2026-11-08 11:41 UTC -
web:windowsreport.com
Microsoft has confirmed that the October 2026 Patch Tuesday updates can cause authentication failures on some Wi-Fi, Ethernet, and VPN connections. The problem stems from Microsoft's decision to enforce restrictions on legacy NTLMv1 authentication by default. According to Microsoft's ...
2026-11-08 11:41 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-11-08 11:41 UTC -
web:www.oracle.com
Oracle Security Alert Advisory - CVE - 2026 -91403 Description This Security Alert addresses CVE - 2026 -91403 by providing Java updates which distrusts the set of impacted intermediate CA certificates related to eMudhra. To address this CVE , update to the latest Java version or apply the recommended mitigations . For more information refer to https://ops.java/emudhra and the Patch Availability ...
2026-11-08 11:41 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-119500.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119500",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T18:00:32.541280Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T18:06:02.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "html5-video-player",
"product": "Flash & HTML5 Video",
"vendor": "bPlugins",
"versions": [
{
"changes": [
{
"at": "2.14.2",
"status": "unaffected"
}
],
"lessThanOrEqual": "2.14.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dzaku | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-11-07T10:11:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.<p>This issue affects Flash & HTML5 Video: from n/a through 2.14.1.</p>"
}
],
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.1."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T10:11:35.846Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/html5-video-player/vulnerability/wordpress-flash-html5-video-plugin-2-14-1-cross-site-scripting-xss-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Flash & HTML5 Video plugin to the latest available version (at least 2.14.2)."
}
],
"value": "Update the WordPress Flash & HTML5 Video plugin to the latest available version (at least 2.14.2)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-119500",
"datePublished": "2026-11-07T10:11:35.425Z",
"dateReserved": "2026-10-30T09:20:18.656Z",
"dateUpdated": "2026-11-07T18:06:02.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}