High · 7.1 CVE-2026-93512 EUVD-2026-89823GHSA-86x3-j3wx-4cmm

WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability

Published Sep 30, 2026 · Updated Sep 30, 2026 · Assigned by Patchstack

Vendor: ilGhera Product: JW Player for WordPress Category: Web / CMS

Description

Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

Affected products

Vendor	Product	Affected	Fixed
ilGhera	JW Player for WordPress	≤ 2.3.11	—

References

https://patchstack.com/database/wordpress/plugin/jw-player-7-for-wp/vulnerability/wordpress-jw-player-for-wordpress-plugin-2-3-11-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry