The Voltax Video Player plugin is vulnerable because the id parameter is not properly sanitized or escaped, allowing an authenticated user with Contributor level or higher to store malicious JavaScript in the database. When any user visits the affected page, the injected script runs in the victim’s browser, providing a cross‑site scripting attack that can steal credentials, deface the site, or install malware. This is a classic CWE‑79 "Improper Neutralization of Input During Web Page Generation" flaw.

WordPress sites running the Voltax Video Player plugin version 1.6.5 or earlier are affected. The vulnerability is present in all editions of the plugin up to and including version 1.6.5.

The CVSS score of 6.4 indicates a moderate severity, and the very low EPSS score (<1%) suggests that public exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. An attacker must first have Contributor‑level or higher authentication to inject the payload, after which all site users that view the compromised page become victims. Because exploitation requires legitimate login credentials, the risk is largely confined to compromised or malicious internal accounts unless an attacker obtains such credentials.