Is the HTML5 Media plugin vulnerable to the MediaElement.js vulnerabilities mentioned here: https://wordpress.org/news/2016/05/wordpress-4-5-2/ ?
Is the HTML5 Media plugin vulnerable to the MediaElement.js vulnerabilities mentioned here: https://wordpress.org/news/2016/05/wordpress-4-5-2/ ?
It appears that it is. The problem is directly in the Flash file included with MediaElement.js, so what HTML5 Media does in its own code is basically irrelevant.
I've released version 2.6 of HTML5 Media, which updates MediaElement.js to the fixed release 2.21.2.