CVE-2026-10092

Name of the Vulnerable Software and Affected Versions Cincopa video and media plug-in versions prior to 1.164

Description The Cincopa video and media plug-in for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the plugin processes the [cincopa] shortcode via a comment text filter hook without sufficient input sanitization and output escaping. Consequently, unauthenticated attackers can inject arbitrary web scripts through post comments that execute when a user accesses the affected page.

Recommendations Update the plugin to a version later than 1.163.