The Media Player Addons for Elementor plugin for WordPress is vulnerable to stored cross‑site scripting because certain widget attributes—subtitle_ssize, track_title, and track_artist_name—are neither sanitized nor properly escaped. This weakness allows authenticated contributors or higher to inject arbitrary HTML or JavaScript into pages that display the affected widget. An attacker could then execute malicious scripts in the context of any visitor to the site, potentially defacing content, stealing session cookies, or executing other client‑side attacks. The flaw is a classic input validation and output encoding problem identified as CWE‑79.

The vulnerable software is the Media Player Addons for Elementor – Audio and Video Widgets for Elementor plugin for WordPress. All releases up to and including version one point zero point five contain the flaw; users of earlier versions are also affected.

The CVSS score of 6.4 classifies the issue as medium severity. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, the required attacker privilege is only contributor‑level or higher, which is difficult to obtain for an external attacker but realistic for a disgruntled or compromised internal user. If exploited, the impact could enable persistent client‑side attacks, defacement, or credential theft on the site.