VULNERABILITY INTELLIGENCE

CVE-2025-3752

CVSS score6.4 MEDIUM

EPSS probability0.27%

CISA KEVNot currently listed

Published2025-04-25

Last modified2026-06-17

Description

The Able Player, accessible HTML5 media player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘preload’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit…