The Cool YT Player plugin accepts the 'videoid' attribute without proper sanitization or escaping, enabling an authenticated attacker with Contributor role or higher to embed arbitrary JavaScript that executes for all users who view the affected page. This can result in defacement, credential theft, or the delivery of malicious payloads. The vulnerability is a classic stored XSS flaw as defined by CWE‑79.

All installations of the Cool YT Player plugin for WordPress versions 1.0 and earlier, developed by Matias Anca, are affected. Users running WordPress sites that include these plugin versions are at risk.

The CVSS score of 6.4 marks the flaw as moderately severe, while the EPSS score of less than 1% indicates a low probability of current exploitation. The vulnerability does not appear in the CISA KEV catalog. Exploitation requires authenticated access with at least Contributor privileges; once an attacker injects malicious content via the video shortcode, the script runs on each page load for all site visitors, providing wide-ranging impact for the compromised site.