The WPlyr Media Block plugin suffers from a stored cross‑site scripting vulnerability tied to the '_wplyr_accent_color' parameter. Because user supplied attributes are neither sanitized nor properly escaped, an authenticated user with Administrator privileges can save malicious JavaScript into the plugin’s settings. When a page containing the affected block is rendered, the injected scripts execute in the victim’s browser, enabling session hijacking, data theft, or defacement. This weakness belongs to CWE‑79, a classic input validation and output escaping flaw.

The defect exists in all releases of the wecodify WPlyr Media Block plugin up through version 1.3.0. Site owners running any of those versions from the WordPress Plugin Repository or the plugin’s ‘wplyr-media-block’ tag are affected.

The CVSS score of 4.4 denotes moderate severity, while the EPSS score of less than 1% indicates a low but not nonexistent likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires Administrator access, so an internal threat actor with such privileges can easily inject payloads that will run for every visitor to pages that include the compromised block, providing widespread attack surface.