Improper neutralization of input during web page generation in the HSS Embed Streaming Video plugin allows a reflected cross‑site scripting (XSS) attack. An attacker can craft a malicious URL or input that is echoed back to the victim’s browser, enabling the execution of arbitrary JavaScript in the context of the affected site. This flaw can be used to steal session cookies, deface content, or redirect users to malicious third‑party sites.

WordPress sites that use the HSS Embed Streaming Video plugin from any version through 3.23 are affected. The vendor is hoststreamsell and the product is the HSS Embed Streaming Video plugin.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests that the probability of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. The likely attack vector is external; an attacker convinces a victim to visit a crafted URL or submit input that triggers the reflected script. Once executed in the victim’s browser, the script can perform client‑side attacks such as credential theft or content manipulation.