Attack Vectors

Simple Plyr (slug: simple-plyr) is affected by a Medium severity Stored Cross-Site Scripting (XSS) issue (CVSS 6.4; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) in versions up to and including 0.0.1. The vulnerability is tracked as CVE-2026-1915.

The most likely attack path is through normal content publishing workflows: an authenticated user with Contributor-level access or higher embeds the [plyr] shortcode and supplies a malicious value in the poster attribute. Because this content is stored in WordPress, the injected script can execute later when someone visits the affected page or post.

From a business perspective, this is especially relevant for organizations that allow multiple internal users, contractors, agencies, or partners to contribute content—because the required access level (Contributor+) is common in marketing operations.

Security Weakness

This issue exists due to insufficient input sanitization and output escaping of user-supplied shortcode attributes in Simple Plyr—specifically the poster parameter of the plyr shortcode. In practical terms, the plugin does not adequately treat the poster value as untrusted input before rendering it on the page.

Because it is a stored XSS vulnerability, the malicious content is saved within site content and can affect many visitors over time. The CVSS vector indicates the attacker needs low privileges (PR:L) and no user interaction (UI:N), and it can impact content beyond the original component’s scope (S:C), which increases the business risk if exploited.

Remediation note: there is no known patch available at this time. Organizations should evaluate mitigations based on risk tolerance, and it may be best to uninstall the affected plugin and replace it to reduce exposure.

Technical or Business Impacts

For leadership and compliance teams, the primary concern is that stored XSS can enable attackers to run unauthorized scripts in visitors’ browsers when they view compromised pages. This can translate into brand and customer-trust damage if users experience suspicious popups, redirects, or altered page behavior on public-facing marketing pages.

Potential business impacts include lead and revenue disruption (e.g., altered forms or calls-to-action), data exposure risk (depending on what a script can access in a user’s session), and operational overhead for incident response, content audits, and stakeholder communications. Because the attacker only needs Contributor+ access, the risk increases in environments with many content authors and fast publishing cycles.

Recommended mitigation actions, aligned to typical marketing and enterprise governance: (1) identify and remove or replace Simple Plyr where possible, (2) restrict Contributor access and review who can publish or submit content containing shortcodes, (3) increase monitoring for unauthorized content changes, and (4) consider temporarily disabling the shortcode or plugin functionality if it is not business-critical until a safe replacement is deployed.

Similar Attacks

Stored XSS has been repeatedly used in real-world incidents involving CMS platforms and third-party plugins/themes. Examples include:

CISA Alert: WordPress Content Injection Vulnerability
Wordfence: Stored XSS in Gravity Forms (example of plugin-based stored XSS)
Wordfence: XSS vulnerability write-up (example of XSS impacting WordPress sites)