SZB-0132ca5098
EUVD lists unauthenticated XSS in nicashmu Post Video Players
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- nicashmu
- Product
- Post Video Players
- First seen
Summary
The EU Vulnerability Database (EUVD) entry EUVD-2026-112953, relayed in a Mastodon post, describes an unauthenticated cross-site scripting flaw in Post Video Players versions 1.165 and earlier. The entry gives a CVSS v3.1 score of 7.1 and was published 2026-10-29 and updated 2026-10-30.
If you use nicashmu
Update Post Video Players to a version later than 1.165.
Check the vendor's listing for the fixed version.
Review user-facing pages that embed the plugin for signs of injected scripts.
What the sources say 1
· Mastodon: “Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.” Source