The Dideo plugin’s stored‑XSS vulnerability occurs because the id attribute of the [dideo] shortcode is inserted directly into an iframe src attribute without sanitization or escaping. An authenticated contributor can embed arbitrary JavaScript into the content, causing that script to run for every user who views the affected page. Based on the description, it is inferred that the attacker could steal session cookies, deface content, or redirect users; this illustrates the potential confidentiality and functional impact, but it does not provide privilege escalation on the server.

The flaw exists in the WordPress Dideo plugin for version 1.0 and earlier, developed by mshomali. Only installations running those versions are affected; later releases are not listed as vulnerable.

With a CVSS score of 6.4 the vulnerability is rated moderate. The EPSS score is unavailable, and the CVE is not listed in CISA’s KEV catalog, which is inferred to indicate limited or no widespread exploitation reports. Attacks require authenticated access with contributor rights or higher, and the likely attack vector is the insertion of malicious JavaScript via the ‘id’ attribute of the [dideo] shortcode into a post or page. The payload is stored client‑side, so any user viewing the compromised page will execute the script. The risk is to confidentiality and availability of the site’s content, with all exposed users potentially impacted, but ordinary server‑side logic remains unaffected.