The Bulk YouTube Post Creator plugin contains an improper input validation flaw that allows attackers to inject arbitrary script code into the page output. The reflected XSS can execute when a victim clicks a specially crafted link, giving the attacker the ability to hijack sessions, deface content, or deliver malware. This is designated as CWE‑79 and is assigned a CVSS score of 7.1, indicating a high impact if exploited.

Affected systems are WordPress sites that have the Syed Tahir Ali Jan Bulk YouTube Post Creator plugin version 1.0 or earlier. No specific OS or WordPress version constraints are noted, but any installation of the vulnerable plugin is at risk.

The exploitation requires a crafted URL to be visited by a user and thus is a user‑interaction threat. The EPSS score of less than 1% suggests that widespread exploitation is unlikely, and the vulnerability is not yet listed in CISA’s KEV. Nonetheless, WordPress users who expose the plugin’s input fields or share links are at moderate risk, especially if the site does not enforce strict content‑security policies.