The vulnerability is a reflected cross‑site scripting flaw (CWE‑79) in the Workbox Video from Vimeo & Youtube WordPress plugin. User‑supplied input is not properly neutralized before it is sent back to the browser, allowing an attacker to inject malicious JavaScript into the page that a user views. When the script executes, it can steal session data, deface the site, or carry out other client‑side attacks, compromising user confidentiality and site integrity.

WordPress installations that have the Workbox Video from Vimeo & Youtube plugin version 3.2.2 or earlier are affected. Any site using these versions, whether installed from the WordPress plugin repository or another source, may be exposed.

The CVSS score of 7.1 classifies this as high severity, but the EPSS score of <1% indicates a low likelihood of exploitation in the wild. The vulnerability is not included in CISA’s KEV catalog. As a reflected XSS, the attacker must be able to influence the victim’s request – typically through a malicious URL or link – which suggests the primary attack vector is user interaction with crafted content. Prompt patching is recommended to reduce the risk of exploitation.