Mine CloudVod plugin for WordPress contains a stored cross‑site scripting flaw caused by insufficient sanitization of the ‘audio’ parameter and lack of output escaping. The vulnerability allows an authenticated user with Contributor or higher privileges to store malicious JavaScript that executes whenever a visitor loads a page containing the injected audio.

Every installation of Mine CloudVod LMS on WordPress up to and including version 2.1.10 is affected. The issue is resolved in release 2.2.0, which can be confirmed by reviewing the source code at the provided links.

The flaw carries a CVSS score of 6.4, representing moderate severity, but an EPSS score under 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. Successful exploitation requires a Contributor‑level or higher account that can add or edit audio content, so the attack surface is limited to sites where such privileges are granted. Once an attacker injects a script, it runs in the browser context of any user who visits the affected page, creating a cross‑domain code execution risk.