Medium · 5.9 CVE-2025-62142 EUVD-2025-205962GHSA-mv8j-h3m3-79c2

WordPress Post Video Players plugin <= 1.163 - Cross Site Scripting (XSS) vulnerability

Published Dec 31, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: nicashmu Product: Post Video Players

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allows Stored XSS.This issue affects Post Video Players: from n/a through <= 1.163.

Affected products

Vendor	Product	Affected	Fixed
nicashmu	Post Video Players	≤ 1.163	—

References

https://patchstack.com/database/Wordpress/Plugin/video-playlist-and-gallery-plugin/vulnerability/wordpress-post-video-players-plugin-1-163-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry