This vulnerability arises from improper neutralization of user input during web page generation, allowing the Broadcast Live Video plugin to reflect unchecked data back to a visitor’s browser. Attackers can inject malicious scripts, enabling arbitrary code execution in the context of the victim, which may lead to credential theft, session hijacking, or defacement. The weakness exemplifies CWE‑79, a cross-site scripting flaw.

The issue affects the VideoWhisper.com Broadcast Live Video plugin, including all releases from the earliest available version through 7.3.14. Any WordPress site using this plugin version is potentially vulnerable, regardless of its other components.

With a CVSS score of 7.1, the vulnerability is considered high severity. The EPSS score is not provided, so the current exploitation probability cannot be quantified. The flaw is not listed in the CISA KEV catalog, but reflected XSS without authentication allows any visitor to be targeted, presenting a low‑barrier attack vector for attackers to consume malicious data.