The vulnerability is a stored cross‑site scripting flaw caused by the videozen_conf() function that accepts a POST parameter named "lang" and saves it directly to a WordPress option without any sanitization. When the value is later output inside a textarea element on the plugin settings page, the content is rendered as raw HTML, allowing an attacker to inject custom JavaScript. Users who view the settings page will then execute the embedded script, potentially enabling session hijacking, defacement, or malicious redirects. This flaw is classified as CWE‑79 and requires the attacker to have Administrator or higher privileges to use the vulnerable form.

Theffected system is the WordPress plugin VideoZen from vendor jconti. The flaw exists in all versions up to and including 1.0.1. Any WordPress site that has installed this plugin and permits admin‑level users to modify the "VideoZen available subtitles languages" field is impacted.

The CVSS base score is 4.4, indicating medium‑low severity. No EPSS score is published, and the vulnerability is not currently listed in the CISA KEV catalog. Because the attack requires authentication and administrative access to the plugin’s settings page, it is not exploitable by unauthenticated actors. Nevertheless, within an environment where an attacker gains administrator rights—such as through credential compromise or social engineering—the vulnerability can be leveraged to execute arbitrary scripts with the privileges of any visitor to the settings page. The risk is considered significant for compromised sites, while the likelihood of exploitation outside such conditions is low.