The WordPress Video Embedder plugin contains a CSRF vulnerability that allows an attacker to submit a request on behalf of an authenticated user to store arbitrary JavaScript. The stored script is later rendered as part of a video embed, resulting in stored cross‑site scripting. The primary impact is that an attacker can execute scripts in the victim’s browser, enabling session hijacking, defacement, or data exfiltration.

This issue affects the Video Embedder plugin provided by forsgren and impacts all versions from the initial release up to and including 1.7.1.

The CVSS score of 7.1 indicates a serious threat, but the EPSS score is less than 1%, suggesting that active exploitation in the wild is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need a way to trick a logged‑in administrator into visiting a crafted URL or form submission that triggers the CSRF action. Once executed, the stored script can run whenever that embedded video is displayed, providing persistent cross‑site scripting capabilities.