CVE-2026-124965 is a stored cross-site scripting (XSS) vulnerability in rtCamp Inc.'s rtMedia plugin for WordPress, BuddyPress, and bbPress. It affects versions up to and including 4.7.16. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can execute in users' browsers. The CVSS score is 6.5, indicating a medium severity level.