Stored cross-site scripting in Untapwp Vidplex WordPress plugin
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Vidplex plugin by Untapwp for WordPress, from n/a through 1.0.3, does not neutralize input during web page generation, which allows stored cross-site scripting (CWE-79). An attacker with low privileges can store script that runs in another user's browser when that user interacts with the affected page, and the attack requires user interaction. The impact spans confidentiality, integrity and availability at a low level.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Untapwp Vidplex vidplex allows Stored XSS.This issue affects Vidplex: from n/a through 1.0.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Vidplex.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-07 Threatist record created from CVE-2026-120364
- 2026-11-07 Alias added: GHSA-mgqv-xmgr-2qqv
- 2026-11-07 CISA SSVC decision points changed
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Sources
- CVE-2026-120364 · CVE Program
- CVE-2026-120364 · NVD
- GHSA-mgqv-xmgr-2qqv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences