@haxtheweb/video-player vulnerabilities (npm)

2 vulnerabilities.

• @haxtheweb/video-player npm HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover CVE-2026-46396 Fix available 9.3 CriticalMay 19, 2026
• @haxtheweb/video-player npm HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft CVE-2026-46496 Fix available 9.3 CriticalMay 19, 2026