Is CVE-2026-62039 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62039 being exploited in the wild.

How severe is CVE-2026-62039?

Medium severity, with a CVSS score of 6.5, published 9 October 2026.

Which products and versions are affected?

bPlugins Html5 Audio Player through 2.8.8.

Is there a fix for CVE-2026-62039?

Yes: fixed in 2.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62039 attacked?

It is attacked over the network.

Am I affected by CVE-2026-62039?

Check whether you run bPlugins Html5 Audio Player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62039: bPlugins Html5 Audio Player stored cross-site scripting

CVE-2026-62039 · Severity: medium · CVSS 6.5 · Published 2026-10-09

Html5 Audio Player is a WordPress plugin that adds audio playback functionality to websites. The plugin contains a stored cross-site scripting (XSS) vulnerability that allows attackers with contributor or developer privileges to inject malicious scripts. When other users interact with the affected content, these scripts execute in their browsers, potentially stealing session data or redirecting them to malicious sites.

Vendors: bPlugins.

Quick answers

Is CVE-2026-62039 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62039 being exploited in the wild.
How severe is CVE-2026-62039?: Medium severity, with a CVSS score of 6.5, published 9 October 2026.
Which products and versions are affected?: bPlugins Html5 Audio Player through 2.8.8.
Is there a fix for CVE-2026-62039?: Yes: fixed in 2.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62039 attacked?: It is attacked over the network.
Am I affected by CVE-2026-62039?: Check whether you run bPlugins Html5 Audio Player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.9.0

Technical details

The plugin fails to properly sanitize user input during web page generation, allowing stored XSS attacks. An attacker with contributor or developer role privileges can inject malicious JavaScript that persists in the plugin's data and executes in the browsers of site visitors. The vulnerability requires user interaction (administrator or moderator must view or interact with the stored payload).

Affected products

bPlugins Html5 Audio Player through 2.8.8

Timeline

2026-07-13: disclosed: Reported by Ananda Dhakal
2026-10-09: advisory: Published by Patchstack

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.