Description
Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.
Published: 2026-10-06
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary script execution via unauthenticated XSS
Action: Immediate Patch
AI Analysis

Impact

An unauthenticated cross‑site scripting flaw exists in the bPlugins Video Background Block WordPress plugin up to version 2.0.3. When a user views a page that includes the plugin’s video‑background block, an attacker can embed malicious JavaScript into the block’s content. This allows attackers to run arbitrary code in the context of the victim’s browser, potentially enabling session hijacking, defacement, or credential theft.

Affected Systems

The vulnerability affects the WordPress plugin BPlugins Video Background Block, versions 2.0.3 and earlier. Any WordPress installation using these versions and displaying the video background block is susceptible.

Risk and Exploitability

The CVSS score is 7.1, indicating a high impact vulnerability. The EPSS score is 0.251%, indicating a very low but non-zero probability of exploitation, and the issue is not listed in CISA’s KEV catalog. Because the flaw is unauthenticated and can be triggered simply by rendering pages that use the plugin, the attack surface is wide. An attacker with no special credentials can inject malicious code by manipulating the plugin’s settings or by posting crafted content that the plugin renders.

Generated by OpenCVE AI on October 7, 2026 at 05:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the bPlugins Video Background Block plugin to the latest version, which removes the input sanitization flaw.
  • If an upgrade is not immediately possible, remove or disable the plugin to prevent the injection vector.
  • As a temporary measure, configure the WordPress site to enforce strict content security policies that block inline scripts and restrict trusted sources.

Generated by OpenCVE AI on October 7, 2026 at 05:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Bplugins
Bplugins video Background Block – Use Video As Background In The Section.
Wordpress-extensions
Wordpress-extensions video Background Block Use Video As Background In The Section
Vendors & Products Bplugins
Bplugins video Background Block – Use Video As Background In The Section.
Wordpress-extensions
Wordpress-extensions video Background Block Use Video As Background In The Section

Tue, 06 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.
Title WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Bplugins Video Background Block – Use Video As Background In The Section.
Wordpress-extensions Video Background Block Use Video As Background In The Section
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-06T10:31:30.659Z

Reserved: 2026-04-29T07:06:45.122Z

Link: CVE-2026-42634

cve-icon Vulnrichment

Updated: 2026-10-06T10:28:49.026Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T09:17:55.047

Modified: 2026-10-06T15:04:25.990

Link: CVE-2026-42634

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T05:30:13Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')