# CVE-2026-119500: bPlugins Flash & HTML5 Video stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-119500-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-119500 · Severity: medium · CVSS 6.5 · Published 2026-11-07

A WordPress plugin that plays video content allows attackers to inject malicious scripts into a website. A privileged user (contributor or developer) must be tricked into performing an action that triggers the attack, which can then steal visitor data or hijack their accounts.

Vendors: [bPlugins](https://junglewise.ai/threats/vendors/bplugins).

## Quick answers

**Is CVE-2026-119500 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119500 being exploited in the wild.

**How severe is CVE-2026-119500?** Medium severity, with a CVSS score of 6.5, published 7 November 2026.

**Which products and versions are affected?** bPlugins Flash & HTML5 Video through 2.14.1.

**Is there a fix for CVE-2026-119500?** Yes: fixed in 2.14.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119500 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-119500?** Check whether you run bPlugins Flash & HTML5 Video at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.14.2

## Technical details

Improper input neutralization in the Flash & HTML5 Video html5-video-player component allows stored XSS via inadequate sanitization of user-supplied input during web page generation. The vulnerability requires contributor or developer-level privileges and user interaction; successful exploitation lets attackers execute arbitrary JavaScript in the context of the website and its visitors' browsers.

## Affected products

- bPlugins Flash & HTML5 Video through 2.14.1

## Timeline

- 2026-10-30: disclosed: Reported to Patchstack
- 2026-11-07: advisory: Published by Patchstack

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/html5-video-player/vulnerability/wordpress-flash-html5-video-plugin-2-14-1-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/html5-video-player/vulnerability/wordpress-flash-html5-video-plugin-2-14-1-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [bPlugins Flash & HTML5 Video stored cross-site scripting](https://junglewise.ai/threats/cve-2026-118097-improper-neutralization-of-input-during-web-page-generation)