Improper neutralization of script-related HTML tags in the Aviplugins Videos WordPress plugin allows attackers to inject malicious scripts via reflected XSS. The weakness, identified as CWE-80, can enable an attacker to execute arbitrary JavaScript in a user's browser when a crafted URL or input is processed by the plugin, potentially leading to data theft, session hijacking, or defacement.

The vulnerability affects the Aviplugins Videos WordPress plugin for all releases up to and including version 1.0.5, with no explicitly lower bound specified. Any WordPress site running this plugin within that version range is susceptible.

With a CVSS score of 7.1, the issue represents moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, exploitation is possible through standard web requests that echo unsanitized user input, making the attack vector likely remote via the public network.