The vulnerability is an improper neutralization of user input during web page generation, classified as a DOM‑based Cross‑Site Scripting flaw that allows an attacker to inject malicious scripts into the browser context. Such injection could lead to the execution of arbitrary JavaScript, enabling session hijacking, defacement, phishing, or the execution of further attacks in the victim’s browser. The weakness corresponds to CWE‑79, a well‑known input validation issue. The description does not specify additional privilege escalation or remote code execution, so the impact is limited to the browser of anyone who visits a page rendered by the affected plugin.

The issue affects the WordPress Videopack plugin developed by Kyle Gilman, specifically all releases up to version 4.10.3. Users running WordPress with this plugin installed at any version equal to or lower than 4.10.3 are vulnerable.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is listed as less than 1 %, reflecting a very low likelihood of exploitation at this time. The vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector is that an attacker supplies crafted input that the plugin fails to neutralize, which then gets rendered in the user’s browser. Because it is a DOM‑based flaw, an attacker can exploit it by simply visiting a URL that triggers the vulnerability, without needing credentials or server‑side access.