Improper neutralization of user‑controlled input in the vooPlayer v4 plugin gives attackers the ability to inject arbitrary JavaScript that executes within the context of the site. This reflected cross‑site scripting flaw can be exploited when the plugin renders input from user‑controlled sources. Based on the description, the likely attack vector is through crafted URLs or form inputs that are processed by the plugin. This inference is not explicitly stated in the CVE data.

Bill Zimmerman vooPlayer v4 plugin – versions up to and including 4.0.4 are affected, spanning from the earliest releases through 4.0.4.

The CVSS score of 7.1 indicates moderate to high risk. The EPSS score of <1% suggests a low probability of exploitation at present, though attackers could manually craft malicious input. The vulnerability is not listed in CISA's KEV catalog. Based on the nature of the vulnerability, it could potentially affect confidentiality, integrity, or availability aspects, but specific consequences are not given in the CVE description. This is an inference and not explicitly stated in the CVE data.