This vulnerability is a contributor‑level Cross Site Scripting flaw that allows an attacker to inject arbitrary JavaScript into the plugin’s output. Based on the description, it is inferred that the input is rendered without adequate sanitization, enabling the injected script to execute in other users’ browsers, potentially leading to session hijacking, defacement, or phishing. The weakness is a classic input validation issue identified as CWE‑79.

WordPress sites that have installed the Video Conferencing with Zoom plugin by Deepen Bajracharya, version 4.6.8 or earlier. All users with contributor or higher role permissions can trigger the flaw by submitting data that the plugin renders.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a contributor account submitting malicious content; this requirement is inferred from the nature of the flaw. Exploitation is achievable through normal use of the plugin, as the crafted input reaches the rendering path without additional privileges.