High · 7.1 CVE-2026-54864 EUVD-2026-112953GHSA-5hwq-83g8-qmhf

WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability

Published Oct 29, 2026 · Updated Oct 30, 2026 · Assigned by Patchstack

Vendor: nicashmu Product: Post Video Players

Description

Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.

Affected products

Vendor	Product	Affected	Fixed
nicashmu	Post Video Players	≤ 1.165	—

References

https://patchstack.com/database/wordpress/plugin/video-playlist-and-gallery-plugin/vulnerability/wordpress-post-video-players-plugin-1-165-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry