The vulnerability is an improper neutralization of input during web page generation in the nicashmu Post Video Players plugin. Stored malicious scripts can be injected through the plugin’s input fields and later rendered by the web application. An attacker who successfully submits such content can have the script executed in the browsers of any visitors who load the affected page, leading to session hijacking, credential theft, defacement, or delivery of additional malware. This is a moderate‑severity XSS flaw classified as CWE‑79.

WordPress sites that have the nicashmu Post Video Players plugin installed, specifically any release from the initial version through version 1.163 inclusive. The plugin is distributed under the name Post Video Players and is deployed on WordPress installations of any edition. No specific WordPress core or theme version is mentioned, so all WordPress hosts using the affected plugin are potentially vulnerable.

The CVSS score of 5.9 indicates a moderate impact. The EPSS score of less than 1% suggests that exploitation in the wild is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is inferred to be a stored XSS that exploits form or content input within the plugin; any user with permission to add or edit media or gallery entries can create the malicious payload. If the plugin is used on public sites where all visitors can view the stored content, the risk of widespread compromise increases. Prompt patching is therefore recommended to mitigate potential abuse.