The vulnerability is an unauthenticated Cross‑Site Scripting flaw in the Post Video Players plugin versions 1.165 and earlier. A malicious actor can inject arbitrary JavaScript that executes in the context of any user who views a page that renders the affected plugin's output. This allows attackers to steal session cookies, deface content, or launch further payloads. The flaw originates from insufficient input sanitization in the plugin’s handling of video metadata or other user‑supplied fields. No additional exploitation prerequisites are listed.

The issue affects WordPress installations running the nicashmu Post Video Players plugin at version 1.165 or earlier. Users who have not upgraded beyond 1.165 are exposed. The plugin is a third‑party media‑display component commonly used to embed video galleries.

The CVSS base score of 7.1 reflects a moderate‑to‑high impact for unauthenticated users. The EPSS score is missing, so the likelihood cannot be quantified, but XSS vulnerabilities typically have predictable exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed large‑scale attacks yet. The attack vector is inferred to be unauthenticated through web input fields, as the flaw is described as unauthenticated. Until a patch is applied, any user who interacts with a page rendering the plugin may be affected.