The Transcoder plugin for WordPress contains an improper neutralization of input during web page generation, allowing attackers to inject malicious JavaScript that is stored in the database and executed when visitors view affected pages. This stored cross‑site scripting vulnerability can lead to defacement, credential theft, or the compromise of a user’s session, posing a moderate to high risk to confidentiality, integrity, and availability.

The affected product is the rtCamp Transcoder plugin for WordPress, with all versions up to and including 1.4.0 being vulnerable. Version identifiers are listed as n/a through <=1.4.0, indicating that any release prior to 1.4.1 lacks the fix.

The CVSS score of 6.5 reflects a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit has been disclosed. The likely attack vector involves an attacker entering malicious payloads through the plugin’s data handling interface or by submitting crafted requests; successful exploitation requires write access to content via the Transcoder plugin.