JW Player for WordPress

JW Player for WordPress has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 4.8, and the most serious one scores 5.3 out of 10.

The most common weakness is Missing Authorization, behind 2 of the records (100%).

Every one of the 2 issues recorded for JW Player for WordPress has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. JW Player for WordPress is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
4.8/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all JW Player for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2024-33931

JW Player for WordPress <= 2.3.3 - Missing Authorization

Read the full analysis

Vulnerability Records

2 records
JW Player for WordPress banner
Latestv2.3.11

JW Player for WordPress

ilGhera

Author

ilGhera

3.8(29)
76/100
Last Updated
2026-08-22 (22d ago)
Active Installs
1,000+
Downloads
190,688
Requires WP
5.0+
Requires PHP
0+
Tested up to
WP 7.1
Created
2015-09-19 (11y ago)

JW Player for WordPress enables you to publish videos on your WordPress posts and pages using the most popular video player on the web. Take complete control of your player, from branding to size and dimensions. Allow users share and embed your videos from your WordPress pages & posts. Free Features (NEW!): Connect to the JW Player Dashboard using your API v2 credentials Select and publish videos hosted on JW Player Select and publish playlist hosted on JW Player Support shortcodes like [jwplayer fPHnET5D] Cloud Register a JW Player account at https://www.jwplayer.com/pricing/ Once you’re logged in, copy your Cloud Hosted Player Libraries from https://dashboard.jwplayer.com/#/players/downloads Paste your library url to the plugin options page. Self hosted https://www.jwplayer.com/pricing/ Once you’re logged in, download the player and copy your License key from https://dashboard.jwplayer.com/#/players/downloads Upload the folder to your site Add the full url of jwplayer.js in the plugin options page (ex. https://example.com/FOLDER-UPLOADED/jwplayer.js) Paste your License Key to the admin page of the plugin. After that, set your general preferences, choose the post types where you want to add videos and start to add content using the JW Player for WordPress box that you’ll find there. Just add the url of your self-hosted video or select cloud-hosted content from n your JW Player Dashboard. That’s it, you’re ready to go!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C