Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions. (CVE-2026-78281)

CVE-2026-78281 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting CP Media Player versions up to 1.3.0. The vulnerability allows remote attackers to inject and execute arbitrary scripts in the context of users' browsers, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no privileges, but requires user interaction. No official patch or vendor advisory is provided in the available data.

Successful exploitation could allow attackers to execute arbitrary scripts in users' browsers, potentially leading to limited disclosure of information, modification of data, or disruption of service. The vulnerability affects confidentiality, integrity, and availability with low impact levels. Since the attack requires user interaction, the risk is somewhat mitigated by user behavior.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted content in CP Media Player. No official mitigation or workaround is provided in the available data.