CVE-2026-85415CWE-79cross-site-scripting

CVE-2026-85415

Medium · published September 30, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
13.7
In the wild
Unconfirmed
What it is

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link (such as an administrator or editor reviewing the post).

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00235 · 13.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-30T10:17Z
References (1)
https://wpscan.com/vulnerability/3ca9c087-311b-4c55-8871-fba318f654b3/ · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 0%
    epss
  • 30 SEP 06:00Z
    Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL
    cvelistv5