CVE-2026-85415

Name of the Vulnerable Software and Affected Versions Audio Player Block versions prior to 1.6.3

Description Insufficient validation of the scheme in user-supplied URLs used as link targets allows users with the Contributor role and above to perform a stored cross-site scripting attack. This occurs when malicious JavaScript is stored and subsequently executed in the session of any user who triggers the link, such as an administrator or editor reviewing a post.

Recommendations Update Audio Player Block to version 1.6.3 or later.