JW Player for Flash & HTML5 Video

JW Player for Flash & HTML5 Video has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2015; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 4.8, and the most serious one scores 5.4 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2015.

2 independent researchers contributed these findings, one record each.

01234567891010.06.2014Today10.06.20144.3JW Player for Flash & HTML5 Video < 2.1.4 - Cross-Site Request Forgery leading to player deletion CVSS 4.3 · 10.06.201421.11.20155.4JW-Player-Plugin-For-Wordpress <= 2.1.14 - Reflected Cross-Site Scripting CVSS 5.4 · 21.11.2015

Strategic Overview

Avg CVSSMedium
4.8/ 10
Patch Coverage50%
Open

1

Fixed

1

Get automatic notifications for all JW Player for Flash & HTML5 Video vulnerabilities before they are exploited.

Most severe open issueCVSS 5.4

JW-Player-Plugin-For-Wordpress <= 2.1.14 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Showing 1–2 of 2 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C