The Docus – YouTube Video Playlist plugin contains a flaw that lets an authenticated user with Contributor or higher access store arbitrary JavaScript via the docusplaylist shortcode. Because the plugin does not sanitize or escape the attributes, the malicious script is saved in the database and is rendered whenever the page is viewed, allowing the attacker to run code in the context of any visitor. This can lead to session hijacking, credential theft, defacement, or redirection.

All WordPress sites that have installed the Docus – YouTube Video Playlist plugin version 1.0.6 or earlier are affected. The vulnerability is present in every earlier release, and the issue exists regardless of the host operating system or WordPress core version. No additional dependencies are listed beyond the plugin itself.

The CVSS score is 6.4, indicating a medium severity vulnerability. The EPSS score is less than 1 %, suggesting low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authentication as a Contributor or higher, and an attacker must place a malicious shortcode in a post or page that is subsequently accessed by other users. Because the payload is executed in the browser, the danger is confined to the web context, but any compromised session can enable further compromise.