Stored Cross-Site Scripting Vulnerability in Cincopa Video Plugin for WordPress
CVE-2026-10092

7.2HIGH

Key Information:

Vendor

WordPress
Status
Cincopa Video And Media Plug-in
Vendor
CVE Published:
24 June 2026

What is CVE-2026-10092?

The Cincopa Video and Media Plugin for WordPress is affected by a vulnerability that allows unauthenticated users to execute arbitrary web scripts on affected sites. This issue arises from improper input sanitization and output escaping when processing comments with the [cincopa] shortcode. Attackers can leverage this flaw to inject malicious scripts into the database, which will be executed for users visiting the affected pages. It is crucial for site administrators to update to the latest version of the plugin to mitigate this risk.

Affected Version(s)

Cincopa video and media plug-in 0 <= 1.163

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/video-playlist...
https://plugins.trac.wordpress.org/browser/video-playlist...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Youcef Hamdani
.