This vulnerability is a Stored Cross‑Site Scripting flaw in the External Video For Everybody WordPress plugin (versions up to 2.1.1). It allows an attacker who can inject content into the plugin to persist malicious JavaScript that is then rendered in the browsers of site visitors. Such injected code can hijack user sessions, steal credentials, or deface the site. The flaw is categorized under CWE‑79.

The affected product is the External Video For Everybody plugin developed by kwiliarty, a WordPress plugin used to embed and manage external videos. Versions through and including 2.1.1 are vulnerable; any WordPress site that has installed this plugin and has not updated beyond 2.1.1 is at risk.

The vulnerability has a CVSS score of 6.5 and an EPSS score of less than 1%, indicating a moderate severity but a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is most likely two‑step: first, an attacker must obtain permission to alter content or plugin data, and then triggers the stored payload so it executes in the browsers of ordinary visitors. If successful, the attacker can execute arbitrary client‑side code, compromising confidentiality, integrity, and availability from the perspective of site users.