The Simple Plyr plugin for WordPress is vulnerable to stored cross‑site scripting because the plugin fails to sanitize or escape user‑supplied content supplied via the 'poster' attribute in the 'plyr' shortcode. This flaw allows an authenticated attacker with Contributor or higher privileges to embed arbitrary JavaScript that will execute for any visitor who views a page containing the injected shortcode. The impact includes defacement, credential theft, or distribution of malicious payloads within the site's user base.

WordPress sites that have installed the Simple Plyr plugin by bestony, any release version up to and including 0.0.1. The vulnerability is present in all affected versions, regardless of other WordPress configurations.

The CVSS v3 score is 6.4, indicating a moderate severity. The EPSS score is below 1%, suggesting a low but non‑zero likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access for a user with Contributor or higher role, after which an attacker can inject malicious scripts via the shortcode that persist and run whenever the affected page is visited by any user. The attack surface is confined to the plugin’s shortcodes, but the actual damage can be widespread across all users of the affected site.