The vulnerability is an improper neutralization of input during web page generation, classified as a stored cross‑site scripting flaw. An attacker could inject malicious script into the media player widget, causing it to be executed in the browsers of users who view the affected page. The stored nature means the payload remains on the site for all users.

The flaw exists in the Media Player Addons for Elementor – Media Player widget for WP plugin, version 1.1.10 and earlier, as distributed by bPlugins. The plugin is used within WordPress installations that incorporate the Elementor page builder. No other vendors or product versions are listed in the data.

The CVSS score of 6.5 indicates moderate severity, and the exploit probability is unknown because the EPSS score is not available. The vulnerability is not in the CISA KEV list, so there are no existing widespread reports of exploitation. Attackers would need to be able to submit content to the widget or otherwise influence the stored data. Based on the description, it is inferred that the attacker needs write access to the widget content, or a way to embed malicious scripts through the plugin's input fields. In a typical WordPress environment, an authenticated attacker with permission to add or edit widget content could insert malicious code, which would then run in any visitor's browser when the page is loaded.