Technical impact
The flaw lies in the VOD Infomaniak plugin’s failure to properly neutralize user input when generating web pages, allowing attackers to store malicious scripts that execute in the browsers of other site visitors. An attacker who can insert arbitrary HTML or JavaScript will have the same privileges as that visitor, enabling defacement, cookie theft, or more subtle phishing attacks. The weakness is a classic web input validation error.
Affected Systems
Infomaniak’s VOD Infomaniak WordPress plugin, any installation version up to and including 1.5.14, regardless of build or environment, is affected.
Risk and Exploitability
The vulnerability carries a CVSS score of 7.1, indicating a moderate‑to‑high risk. EPSS data is not available, so precise exploitation likelihood is unknown, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it by submitting malicious input through the plugin’s interfaces—such as media titles, descriptions, or comment fields—where the content is later rendered without sanitization. Successful exploitation requires the attacker’s input to be stored and rendered to other users who view the affected pages.
