This vulnerability is a classic Reflected Cross‑Site Scripting flaw (CWE‑79) that exists in the JW Player for WordPress plugin through version 2.3.11. It allows an attacker to inject arbitrary JavaScript into pages served by a WordPress site that hosts the plugin, without requiring any authentication. The injected script runs with the privileges of the site visitor, enabling cookie theft, session hijacking, defacement, or distribution of malware. The impact therefore directly jeopardises the confidentiality, integrity and availability of the site’s users and content.

Any WordPress installation that has the ilGhera JW Player for WordPress plugin installed in a version 2.3.11 or older is vulnerable. No additional operating‑system or PHP version constraints are listed, so the issue applies broadly to WordPress sites simply running an outdated copy of the plugin.

The plugin’s CVSS score of 7.1 rates it as High severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the lack of protection means an unauthenticated attacker can exploit it by sending a crafted URL or emerging from a user‑generated field to any visitor of the site. Because the flaw is reflected in the browser and cross‑origin script execution is typically permitted, the attack vector is external. If the site’s user base is large or the plugin is exposed to untrusted content, the probability of exploitation can rise.