This vulnerability is a stored XSS flaw (CWE‑79) that allows an unauthenticated user to embed malicious script code via the cincopa shortcode in WordPress comments. The payload is stored in the database and will execute in any browser that loads the page, potentially compromising credentials, defacing the site, or redirecting users to malicious content.

All WordPress sites using the Cincopa video and media plug‑in up to version 1.163 are affected. The vulnerability is tied to the plugin’s handling of the [cincopa] shortcode via the comment_text filter hook.

The CVSS score of 7.2 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, which means it is not tied to a publicly known exploit campaign. Nonetheless, the attack vector is readily exploitable: any user able to post a comment can inject the payload, and the payload remains until the comment is deleted. This makes the threat significant, especially for sites with open comment sections and no additional input validation.