A stored cross‑site scripting flaw exists in the Reward Video Ad for WordPress plugin through unfiltered admin settings such as the Account ID, pre‑video message, and color options. This weakness allows an attacker with Administrator or higher privileges to embed malicious scripts that will run whenever any visitor loads a page containing the injected settings, potentially defacing the site, stealing cookies, or hijacking sessions. The flaw is classified as CWE‑79 and raises concerns over confidentiality and integrity for users who interact with the compromised site.

Organizations running the Reward Video Ad for WordPress plugin by applixir on any version up to and including 1.6 are affected. The vulnerability manifests when the plugin’s settings are edited via the WordPress admin dashboard; all WordPress installations that include this plugin version inherit the risk.

The CVSS score is 4.4, indicating a moderate risk level. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not yet widely exploited. Exploitation requires authenticated Administrator access, which means only users with legitimate admin credentials or compromised admin accounts can deploy the payload. Once the script is stored, it will execute on every page load, making the impact persistent while the plugin remains installed.