The FitVids plugin for WordPress 4.0.1 or earlier stores unsanitized input from the admin settings, allowing an authenticated administrator to inject arbitrary JavaScript into content that is rendered to all users. The flaw can lead to theft of credentials, session hijacking, or defacement when any site visitor loads a page that contains the injected code.

WordPress sites running the FitVids for WordPress plugin version 4.0.1 or earlier. The issue is limited to multisit installations and those where the unfiltered_html option is disabled, as only the former can store malicious scripts via the settings page.

The CVSS score of 4.4 indicates low‑to‑moderate severity, and the EPSS score of <1% shows a very small chance of exploitation. The vulnerability is not in the CISA KEV catalog, suggesting it is not a known exploited vulnerability. An attacker must be a site administrator or higher to use the flaw; once injected, the script runs for any visitor, creating a persistent attack surface that could lead to credential theft or defacement.