The Target Video Easy Publish plugin for WordPress allows authenticated users with Contributor level or higher to inject arbitrary JavaScript into the 'width' parameter of its shortcode. This insufficient sanitization and lack of output escaping leads to persistent XSS that executes whenever a page containing the injected content is viewed. The resulting vulnerability is a classic client‑side injection flaw (CWE‑79) that can compromise user confidentiality, integrity of the webpage, and can potentially be leveraged for phishing or credential theft.

The flaw exists in all releases of the Target Video Easy Publish plugin up to and including version 3.8.5, distributed by nebojsadabic on WordPress. Sites employing any of those versions are affected; newer versions beyond 3.8.5 are not impacted.

The CVSS score of 6.4 indicates a medium severity. The EPSS score of less than 1% suggests exploitation likelihood is currently very low, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack path requires the attacker to possess at least Contributor‑level authentication. Once access is obtained, injected scripts will run in the context of any user who views a page containing the malicious width attribute, potentially allowing session hijacking or defacement.