The vulnerability is a reflected cross‑site scripting flaw in the Video Blogster Lite plugin, caused by insufficient input sanitization. When attackers supply malicious input that is echoed back into the page, they can inject JavaScript into the visitor's browser. This can lead to theft of session cookies, defacement, phishing, or redirection to malicious sites, compromising confidentiality, integrity, and availability of the web application.

The flaw exists in all releases of the johnh10 Video Blogster Lite WordPress plugin up through version 1.2. WordPress sites that have installed or are running this plugin without an update are affected.

The CVSS score of 7.1 categorizes this as high severity, and the EPSS score of less than 1 % indicates a low probability of immediate exploitation. The attack vector is through the web interface, where an attacker can embed a malicious payload in a URL or form that the plugin echoes back to the user. Because the vulnerability is a reflected XSS, it can be leveraged without authentication, and is listed as not in CISA’s KEV catalog.