The Blue Wrench Video Widget plugin contains an improper neutralization of input during web page generation. A malicious payload supplied by an attacker is reflected unescaped into the page, allowing the injection of arbitrary JavaScript in the victim’s browser. This client‑side code execution can lead to session hijacking, credential theft, defacement, or malicious redirects. The impact is confined to the user’s browser session and can compromise user credentials and site integrity

All WordPress installations that use the Blue Wrench Video Widget plugin version 2.1.0 or earlier are affected. The plugin is provided by Sunil Nanda. Sites that rely on this widget for video embedding should be considered vulnerable

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation in the wild is unlikely at present, and the vulnerability is not listed in CISA KEV. The likely attack vector is via a crafted URL that includes malicious data in a widget parameter; the attacker does not need authentication, but the victim must visit the page containing the injected payload. This path demonstrates a remote, unauthenticated, client‑side exploitation that is contingent on user interaction.