Improper neutralization of input during web page generation allows the Vidplex plugin to store and subsequently serve malicious JavaScript. The flaw is a Stored XSS vulnerability (CWE‑79) that can lead to session hijacking, credential theft, or defacement when affected users view the compromised content. The impact is confined to the context of the WordPress site but can be leveraged by attackers to attack any user who visits the affected page.

The vulnerability affects the Untapwp Vidplex plugin in WordPress installations that are version 1.0.3 or earlier. No explicit version range beyond that is provided, but all releases up to 1.0.3 are potentially susceptible.

The CVSS score of 6.5 indicates moderate severity. EPSS data is not available, so the likelihood of exploitation remains uncertain, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector appears to be a data‑entry point within the plugin that accepts user input without proper sanitization, storing it for later display. An attacker would need to inject malicious payloads into this input field; once stored, the payload executes in the browsers of any visitor to the affected page.