CVE-2026-85415

Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link (such as an administrator or editor reviewing the post).

Affected

Audio Player Block

CVSS v3.1 CNA

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.24% chance of exploitation in the next 30 days, 14th percentile

Published

2026-09-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/3ca9c087-311b-4c55-8871-fba318f654b3/

References

• CVE Record
• NVD entry