High severity · published Oct 29, 2026
CVE-2026-54864
WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability
New
7.1
CVSS
–
EPSS
No
On KEV
Description
Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PV
Post Video Players · nicashmu
through 1.165 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54864
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54864
vdb-entry
https://patchstack.com/database/wordpress/plugin/video-playlist-and-gallery-plugin/vulnerability/wordpress-post-video-players-plugin-1-165-cross-site-scripting-xss-vulnerability?_s_id=cve
More from Post Video Players
5.9
CVE-2025-62142
WordPress Post Video Players plugin <= 1.163 - Cross Site Scripting (XSS) vulnerability
4.3
CVE-2025-62143
WordPress Post Video Players plugin <= 1.163 - Sensitive Data Exposure vulnerability