Executive brief
The Cincopa video and media plugin for WordPress, which allows users to embed galleries and videos, contains a security flaw that allows unauthorized visitors to inject malicious scripts into website comments. When other users or administrators view these comments, the scripts can execute automatically in their browsers. This could lead to unauthorized actions being performed on behalf of the victim, potentially compromising user sessions or redirecting visitors to malicious websites.
Technical details
The Cincopa video and media plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the [cincopa] shortcode. The vulnerability exists because the plugin processes this shortcode via the 'comment_text' filter hook, which is accessible to unauthenticated visitors who can post comments. An attacker can supply malicious arguments within the shortcode that are then persisted in the database. When a user or administrator views the affected page, the arbitrary web scripts execute in their browser context. This affects all versions up to and including 1.163.
Affected products
- nicashmu Cincopa video and media plug-in up to, and including, 1.163
Timeline
- 2026-06-24: advisory: Advisory published by Wordfence and NVD
References
- https://plugins.trac.wordpress.org/browser/video-playlist-and-gallery-plugin/tags/1.163/wp-media-cincopa.php
- https://plugins.trac.wordpress.org/browser/video-playlist-and-gallery-plugin/tags/1.163/wp-media-cincopa.php
- https://plugins.trac.wordpress.org/browser/video-playlist-and-gallery-plugin/tags/1.163/wp-media-cincopa.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2d6304e5-7fbf-484d-b147-f2a6c2ee0658?source=cve