Improper neutralization of input during web page generation allows attackers to store malicious JavaScript in media objects created by AnyClip Luminous Studio. When affected content is viewed, the stored script is rendered by the victim’s browser, which can execute arbitrary code. This creates the potential for unauthorized access to session data, defacement of content, or other unintended browser actions. The vulnerability is classified as a stored XSS flaw (CWE‑79).

AnyClip Video Platform’s AnyClip Luminous Studio plugin versions up to and including 1.3.3 are vulnerable. The plugin runs inside WordPress and saves user‑supplied media metadata that is later displayed without proper escaping.

The CVSS score of 6.5 indicates a medium level of risk, while the EPSS score of < 1 % reflects a low likelihood of exploitation at present. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would rely on an attacker’s ability to inject content that is stored by the plugin and subsequently rendered in browsers of users who view the affected media. No specific attack vector, privilege requirement, or additional prerequisites are detailed in the CVE data.