CVE-2026-0724

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0724", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-08T13:42:18.405Z", "datePublished": "2026-02-11T08:26:26.444Z", "dateUpdated": "2026-04-08T17:02:19.702Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:19.702Z"}, "affected": [{"vendor": "wecodify", "product": "WPlyr Media Block", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPlyr Media Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_wplyr_accent_color' parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WPlyr Media Block <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4cc65b-b0a7-4002-add4-ceacfe2f54f1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wplyr-media-block/trunk/includes/class-wplyr.php#L434"}, {"url": "https://plugins.trac.wordpress.org/browser/wplyr-media-block/tags/1.3.0/includes/class-wplyr.php#L434"}, {"url": "https://plugins.trac.wordpress.org/browser/wplyr-media-block/trunk/includes/class-wplyr.php#L359"}, {"url": "https://plugins.trac.wordpress.org/browser/wplyr-media-block/tags/1.3.0/includes/class-wplyr.php#L359"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Bhumividh Treloges"}], "timeline": [{"time": "2026-02-10T20:08:39.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:37:05.419747Z", "id": "CVE-2026-0724", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:44:47.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:37:05.419747Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:37:06.159Z"}}], "cna": {"title": "WPlyr Media Block <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Bhumividh Treloges"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wecodify", "product": "WPlyr Media Block", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-10T20:08:39.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4cc65b-b0a7-4002-add4-ceacfe2f54f1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wplyr-media-block/trunk/includes/class-wplyr.php#L434"}, {"url": "https://plugins.trac.wordpress.org/browser/wplyr-media-block/tags/1.3.0/includes/class-wplyr.php#L434"}, {"url": "https://plugins.trac.wordpress.org/browser/wplyr-media-block/trunk/includes/class-wplyr.php#L359"}, {"url": "https://plugins.trac.wordpress.org/browser/wplyr-media-block/tags/1.3.0/includes/class-wplyr.php#L359"}], "descriptions": [{"lang": "en", "value": "The WPlyr Media Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_wplyr_accent_color' parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:19.702Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0724", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:19.702Z", "dateReserved": "2026-01-08T13:42:18.405Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-11T08:26:26.444Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPlyr Media Block", "vendor": "wecodify", "versions": [{"lessThanOrEqual": "1.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPlyr Media Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_wplyr_accent_color' parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin WPlyr Media Block para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro _wplyr_accent_color en todas las versiones hasta la 1.3.0, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-0724", "lastModified": "2026-06-17T10:11:16.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0724", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T15:37:05.419747Z", "version": "2.0.3"}}]}, "published": "2026-02-11T09:15:50.827", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wplyr-media-block/tags/1.3.0/includes/class-wplyr.php#L359"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wplyr-media-block/tags/1.3.0/includes/class-wplyr.php#L434"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wplyr-media-block/trunk/includes/class-wplyr.php#L359"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wplyr-media-block/trunk/includes/class-wplyr.php#L434"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4cc65b-b0a7-4002-add4-ceacfe2f54f1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.0]"}}], "product": "wplyr_media_block", "vendor": "wecodify"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T01:01:58.916835+00:00", "value": {"mitigation_remediation": ["Upgrade WPlyr Media Block to a release newer than 1.3.0; if no newer version exists, consider uninstalling the plugin or disabling it until a fix is released.", "Restrict the use of the plugin to trusted administrators only and ensure that no untrusted users hold administrator or editor roles that could inject malicious input.", "Deploy a strict Content\u2011Security\u2011Policy that disallows inline scripts and restricts script sources to trusted domains, thereby limiting the impact of any residual injected code until the plugin is updated."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The defect exists in all releases of the wecodify WPlyr Media Block plugin up through version 1.3.0. Site owners running any of those versions from the WordPress Plugin Repository or the plugin\u2019s \u2018wplyr-media-block\u2019 tag are affected.", "description_and_impact": "The WPlyr Media Block plugin suffers from a stored cross\u2011site scripting vulnerability tied to the '_wplyr_accent_color' parameter. Because user supplied attributes are neither sanitized nor properly escaped, an authenticated user with Administrator privileges can save malicious JavaScript into the plugin\u2019s settings. When a page containing the affected block is rendered, the injected scripts execute in the victim\u2019s browser, enabling session hijacking, data theft, or defacement. This weakness belongs to CWE\u201179, a classic input validation and output escaping flaw.", "risk_and_exploitability": "The CVSS score of 4.4 denotes moderate severity, while the EPSS score of less than 1% indicates a low but not nonexistent likelihood of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires Administrator access, so an internal threat actor with such privileges can easily inject payloads that will run for every visitor to pages that include the compromised block, providing widespread attack surface."}}}}, "created": "2026-02-11T21:46:02.213851+00:00", "updated": "2026-04-16T01:15:20.517639+00:00", "vendors": ["wecodify", "wecodify$PRODUCT$wplyr_media_block", "wordpress", "wordpress$PRODUCT$wordpress"]}