The vulnerability is an instance of improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that will be executed by a visitor’s browser. If an attacker can craft a request that the plugin reflects into a page, they could steal session cookies, deface the site, or redirect users to malicious sites. The weakness is a classic reflected XSS flaw (CWE‑79).

This flaw affects versions of the WordPress Yahoo! WebPlayer plugin from the earliest release up to and including 2.0.6, which is distributed by the 8bitkid developer. Any WordPress installation that has this plugin installed and has not applied the latest patch is susceptible.

The CVSS score of 7.1 indicates a high severity, and while the EPSS score is <1%, the attack vector is likely reflected, requiring only a crafted URL or input that the plugin will echo. The vulnerability is not listed in the CISA KEV catalog. Attackers with the ability to influence user input or links can exploit the flaw, potentially leading to credential theft and site compromise.