Description

Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-27T10:16:37.760Z",
  "pubdate": "2026-08-27T10:16:37.760Z",
  "executiveSummary": "CP Media Player versions 1.3.0 and below are susceptible to an unauthenticated Cross-Site Scripting (XSS) vulnerability. This security flaw allows remote, unauthenticated attackers to inject arbitrary JavaScript code into the web application's client-side environment. By leveraging this vulnerability, an attacker can execute malicious scripts within the context of a victim's browser session. The primary risk implications include session hijacking, unauthorized access to sensitive user data, and the potential for defacement or redirection of users to malicious external domains. Because the vulnerability is unauthenticated, exploitation does not require valid credentials or prior access to the WordPress environment, significantly lowering the barrier for entry for potential threat actors. Successful exploitation compromises the integrity and confidentiality of the user interaction with the media player plugin, posing a severe threat to any WordPress installation utilizing the affected software versions.",
  "technicalDetails": "The identified vulnerability in CP Media Player <= 1.3.0 stems from inadequate input validation and output encoding of user-supplied data transmitted to the browser. The plugin fails to properly sanitize parameters processed during the media player's rendering process, allowing an attacker to inject arbitrary HTML tags and script elements into the Document Object Model (DOM).\nThe root cause is identified as the application's failure to implement proper context-aware output encoding when handling request parameters. By crafting a specifically engineered URL containing malicious JavaScript payloads, an attacker can cause the application to reflect the payload directly into the response generated by the server. When a legitimate user, such as an administrator or authenticated user, navigates to the manipulated link, the victim's browser executes the injected script.\nThe attack flow proceeds as follows: First, the attacker identifies the vulnerable parameter within the CP Media Player plugin. Second, the attacker crafts a malicious payload—typically containing a document.cookie theft script or a redirection vector—and encodes it within a URL. Third, the attacker distributes this link to targets. Upon the target's request to the compromised URL, the server processes the input and includes the unvalidated payload in the generated HTML page. Finally, the victim's browser interprets the malicious script as legitimate code originating from the trusted origin, leading to execution in the victim's session context.\nThis vulnerability is classified as Reflected XSS. It does not require any authentication, privilege level, or specific user interaction beyond clicking a link. The impact is significant as it allows the attacker to perform actions on behalf of the victim, potentially leading to a full account takeover if an administrator is targeted. Because the script executes in the user's browser, it circumvents standard server-side security measures, posing a substantial risk to both the client and the underlying application architecture."
}