The Able Player plugin for WordPress contains a stored cross‑site scripting flaw in the ‘preload’ parameter. Because the plugin does not properly sanitize or escape the value, authenticated users with Contributor-level access can inject arbitrary web scripts. When users later view the affected page, those scripts run in the context of the website, allowing the attacker to steal session data, deface content, or perform other malicious actions.

Able Player, an accessible HTML5 media player plugin developed by joedolson, is affected for all WordPress versions up to and including 1.2.1. Any installation of Able Player in those releases carries the vulnerability.

The evaluation assigns a CVSS score of 6.4, indicating a medium severity vulnerability that does not require network‑only exploits but can be triggered from within the WordPress environment. With an EPSS score of less than 1 % and the vulnerability not listed in CISA KEV, exploitation is not highly probable in the wild, yet authenticated contributors can still use it to inject scripts. Attackers would need access to the WordPress backend and permissions at Contributor level or higher; once injected, the stored payload is delivered to all subsequent page loads for any user who views the page.