The Lazy Load for Videos plugin is vulnerable to a stored XSS flaw that allows an authenticated contributor or higher to inject malicious script code via the 'data-video-title' and 'href' attributes. Once supplied by the attacker, the plugin decodes HTML entities and writes the raw strings into the page without escaping, causing the script to run for every user who views the affected page. This flaw enables the attacker to manipulate the browser context of other users, potentially leading to session hijacking, defacement, or credential theft.

All WordPress sites running the Lazy Load for Videos plugin by Kevin Weber, in all released versions up to and including 2.18.7. Any installation where contributors have write access to embed videos is susceptible.

The CVSS score of 6.4 indicates medium severity based on integrity impacts, while the EPSS score is under 1%, suggesting a low but non‑zero likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog, implying no confirmed widespread attacks. Nevertheless, because only Contributor‑level access is required, many users in a typical WordPress environment can exploit the flaw. An attacker may inject the malicious code by adding or editing a post, page, or media item that includes the vulnerable attributes; the embedded script will then execute for all visitors who load the page.