Is CVE-2026-119365 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119365 being exploited in the wild.

How severe is CVE-2026-119365?

Medium severity, with a CVSS score of 6.5, published 30 October 2026.

Which products and versions are affected?

bPlugins Media Player Addons for Elementor through 1.1.10.

Is there a fix for CVE-2026-119365?

Yes: fixed in 1.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119365 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119365?

Check whether you run bPlugins Media Player Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119365: bPlugins Media Player Addons for Elementor stored XSS

CVE-2026-119365 · Severity: medium · CVSS 6.5 · Published 2026-10-30

Media Player Addons for Elementor is a WordPress plugin that adds media playback capabilities to websites built with the Elementor page builder. The plugin contains a stored cross-site scripting vulnerability that allows attackers with contributor-level access to inject malicious scripts, which are then executed when other site visitors or administrators view the affected content, potentially stealing visitor data or hijacking their accounts.

Vendors: bPlugins.

Quick answers

Is CVE-2026-119365 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119365 being exploited in the wild.
How severe is CVE-2026-119365?: Medium severity, with a CVSS score of 6.5, published 30 October 2026.
Which products and versions are affected?: bPlugins Media Player Addons for Elementor through 1.1.10.
Is there a fix for CVE-2026-119365?: Yes: fixed in 1.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119365 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119365?: Check whether you run bPlugins Media Player Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.1.11

Technical details

A stored XSS vulnerability in the Media Player widget allows authenticated users with contributor-level privileges to inject malicious JavaScript code that persists in the database. The vulnerability requires user interaction—an attacker with contributor rights must craft and submit a malicious payload, and the script executes when the page is viewed by other users. The fix is available in version 1.1.11.

Affected products

bPlugins Media Player Addons for Elementor through 1.1.10

Timeline

2026-10-30: disclosed
2026-10-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.