CVE-2026-1915: 
WordPress vulnerability analysis and mitigation

CVE-2026-1915 is a Stored Cross-Site Scripting (XSS) vulnerability in the Simple Plyr plugin for WordPress. It affects all versions up to and including 0.0.1, stemming from insufficient input sanitization and output escaping on the poster parameter within the plyr shortcode. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts into pages, which execute when any user visits the affected page. It carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists because the poster attribute passed to the [plyr] shortcode is not properly sanitized before being stored or escaped before being rendered in the page output. An authenticated attacker with at least Contributor-level WordPress privileges can craft a post or page containing a malicious [plyr poster="..."] shortcode embedding JavaScript payloads, which are then stored in the database and executed in the browsers of any visitor who loads the page (Red Hat CVE, Infinitsec).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, potentially leading to session cookie theft, credential harvesting, unauthorized administrative actions, or defacement of the affected WordPress site. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader WordPress environment and its users. Confidentiality and integrity are both impacted at a low level, while availability is unaffected (Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1915 as of the available data. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Simple Plyr plugin version 0.0.1 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a [plyr] shortcode with a malicious poster attribute, e.g., [plyr poster="\"onerror=\"alert(document.cookie)"] or a more sophisticated payload to exfiltrate session tokens.
4. Publish the content: Submit the post/page for publication (or publish directly if permissions allow), causing the malicious payload to be stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the browser renders the unsanitized poster attribute and executes the embedded JavaScript, achieving the attacker's objective (e.g., session hijacking or admin account takeover) (Infinitsec).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing plyr shortcode content with suspicious poster parameter values including HTML event handlers (e.g., onerror, onload) or <script> tags.
• Database: WordPress wp_posts table entries containing [plyr poster= shortcode with encoded or obfuscated JavaScript payloads.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from pages hosting the Simple Plyr plugin shortcode.
• File System: Presence of Simple Plyr plugin version 0.0.1 or earlier at wp-content/plugins/simple-plyr/ on the WordPress installation.

The primary remediation is to update the Simple Plyr plugin to a version beyond 0.0.1 that includes proper input sanitization and output escaping, once such a release is available from the plugin author. If no patched version is available, site administrators should deactivate and remove the Simple Plyr plugin immediately. Additionally, restricting Contributor-level user registrations and reviewing existing Contributor accounts can reduce the attack surface. WordPress administrators should also consider deploying a Web Application Firewall (WAF) with XSS filtering rules as a compensating control (Wordfence).

Wordfence included CVE-2026-1915 in its weekly WordPress vulnerability report for February 9–15, 2026, flagging it as part of routine plugin security monitoring (Wordfence). Infinitsec published a brief technical write-up detailing the vulnerability (Infinitsec). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregation has been observed.