The vulnerability is a DOM‑based Cross‑Site Scripting flaw caused by improper neutralization of input during web page generation in the Able Player plugin for WordPress. An attacker can inject malicious JavaScript that executes in the context of a user’s browser, potentially enabling cookie theft, session hijacking, defacement, or further attacks. This weakness is mapped to CWE‑79.

Affected systems are WordPress sites that use the Joe Dolson Able Player plugin version 1.2.1 or earlier. No more granular version ranges are specified, so all releases up to and including 1.2.1 are impacted.

The CVSS score of 6.5 indicates moderate severity. With an EPSS score of less than 1 % the likelihood of exploitation is currently low, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely a web‑based path where an attacker provides crafted input through the plugin’s configuration or data fields, triggering the XSS payload within the user’s browser.