CVE-2026-78281
WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
CVSS score
7.1
EPSS probability
%0.3
Risk score
0.0
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
7.2
CVE-2026-93624
WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability
C
Patch status unknownEPSS %0
6.5
CVE-2026-66679
WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability
C
Patch status unknownEPSS %0
7.2
CVE-2026-96573
Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
C
Patch status unknownEPSS %0
7.1
CVE-2026-78283
WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability
C
Patch status unknownEPSS %0
6.1
CVE-2026-103909
Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation
C
Patch status unknownEPSS %0
6.1
CVE-2026-100179
Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
C
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2026-78281"