Improper input sanitization in the WordPress Video Embeds plugin allows a malicious actor to store a JavaScript payload that is later executed in a visitor's browser. The stored cross‑site scripting can be used to hijack user sessions, deface content, or exfiltrate data, affecting confidentiality, integrity, and availability of the affected website.

The vulnerability exists in the Ryan Burnette Video Embeds plugin up to and including version 0.1.1. Any instance of the plugin with a version less than or equal to 0.1.1 is affected.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Exploitation would likely require the attacker to inject a malicious script through the plugin’s data entry points, which is stored and subsequently rendered when the plugin displays video content. The attack vector is most probable via administrative or content‑creation interfaces that allow free‑form data entry.