The Videos sync PDF plugin for WordPress, version 1.7.4, accepts user‑controlled data in its media parameters (nom, pdf, mp4, webm, ogg) without proper sanitization. An authenticated user who can reach the plugin options panel can inject JavaScript payloads—such as autofocus or onfocus handlers—that execute in the browser context of any administrator who views or edits the video settings. The resulting arbitrary script execution allows compromise of administrative accounts through phishing or credential theft, impacting confidentiality, integrity, and availability at the administrative level.

WordPress sites using the A‑J‑Evolution Videos sync PDF plugin version 1.7.4 are affected. No other vendors or product versions are listed.

The CVSS score of 5.1 indicates a moderate‑severity vulnerability. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, so public exploitation has not yet been confirmed, though the input explicitly states that authorized attackers can leverage the flaw. Attackers need authenticated access to the WordPress admin interface but can then trigger arbitrary script execution for any administrator who subsequently accesses the plugin settings. The lack of a publicly disclosed exploit does not mitigate the risk, as the vulnerability can be leveraged by any privileged user with knowledge of the plugin’s functions.