What’s Vulnerable › Vulnerabilities
CVE-2026-85415: Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-30 · updated 2026-09-30
- Weakness: CWE-79
Description
The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link (such as an administrator or editor reviewing the post).
Affected products
- Audio Player Block: from 1.1.0 before 1.6.3 — fixed in 1.6.3
How to fix
Upgrade to a fixed version: Audio Player Block 1.6.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-85415 or the next vulnerability affects your stack