CVE-2025-9203

The Media Player Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtitle_ssize', 'track_title', and 'track_artist_name' parameters in version 1.0.5. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/media-player-addons-for-elementor/tags/1.0.5/widgets/b_html5_addon.php#L432
• https://plugins.trac.wordpress.org/browser/media-player-addons-for-elementor/tags/1.0.5/widgets/bplayer-widget-video.php#L207
• https://plugins.trac.wordpress.org/log/media-player-addons-for-elementor/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1067cc82-3595-4228-a7a2-5b3be7677b1f?source=cve

Published

Sep 17, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9197Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-9198The Wp cycle text announcement plugin for WordPress is vulne…6.5
• CVE-2025-9199The Woo superb slideshow transition gallery with random effe…6.5
• CVE-2025-9200The Blappsta Mobile App Plugin – Your native, mobile iPhone …7.5
• CVE-2025-9201A potential DLL hijacking vulnerability was discovered in Le…8.5
• CVE-2025-9202The ColorMag theme for WordPress is vulnerable to unauthoriz…4.3
• CVE-2025-9204The X Addons for Elementor plugin for WordPress is vulnerabl…6.4
• CVE-2025-9205The MapSVG plugin for WordPress is vulnerable to Stored Cros…6.4
• CVE-2025-9206The Meks Easy Maps plugin for WordPress is vulnerable to Sto…6.4
• CVE-2025-9207The TI WooCommerce Wishlist plugin for WordPress is vulnerab…5.3
• CVE-2025-9208Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2025-9209The RestroPress – Online Food Ordering System plugin for Wor…9.8