The Videos sync PDF plugin for WordPress, version 1.7.4, accepts user‑controlled data in its media parameters (mov, pdf, mp4, webm, ogg) without proper sanitization. An authenticated user who can access the plugin options panel can inject JavaScript payloads—such as autofocus or onfocus event handlers—that execute in the browser context of any administrator who views or edits the video settings. The resulting arbitrary script execution allows compromise of administrative accounts through phishing or credential theft, impacting confidentiality, integrity, and availability at the administrative level.

WordPress sites using the A‑J‑Evolution Videos sync PDF plugin version 1.7.4 are affected. No other vendors or product versions are listed.

The CVSS score of 5.1 indicates a moderate‑severity vulnerability. The EPSS score of 0.00029 (less than 0.03%) shows that while exploitation likelihood is very low, it is non‑zero, meaning the flaw could attract data‑browsing or privilege‑focused attackers. The issue is not listed in the CISA KEV catalog, so no public exploit has been confirmed yet. Nonetheless, authenticated attackers can leverage the flaw to execute arbitrary scripts when administrators view or edit the plugin settings.