The Lazy Load for Videos plugin contains a stored XSS flaw that allows an attacker to inject malicious scripts into pages rendered by the website. Once stored, these scripts execute in the browser context of any visitor, permitting theft of session data, cookie data, and potentially credential hijacking. The weakness is an improper neutralization of input, mapping to CWE-79.

The vulnerability affects Kevin Weber’s Lazy Load for Videos plugin for WordPress, versions up to and including 2.18.11. Any WordPress site running these versions is potentially exposed.

The CVSS score of 6.5 denotes a moderate severity, with exploitation primarily occurring through user interaction or content injection. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is an attacker leveraging the plugin's input handling to store malicious script payloads; once placed, the code runs in visitors' browsers, enabling widespread data theft or defacement across the affected site.