The vulnerability resides in the Optimole WordPress plugin before version 4.2.13, where unrecognized attributes within the video‑player block are not escaped before rendering. Users with the Author role or higher can store an arbitrary event‑handler attribute that gets output unfiltered, leading to client‑side script execution in the browsers of any user who views the post. In practice this allows an attacker to inject JavaScript that may hijack sessions, deface content, or download malicious payloads when administrators or other privileged users visit the affected page.

Vulnerable instances are those running Optimole plugin versions 4.0.0 through 4.2.12 on a WordPress installation. The plugin is identified by the vendor designation ‘Unknown:Optimole’. Sites that have not upgraded beyond 4.2.12 are susceptible, regardless of other security configurations.

The CVSS score is 6.8 and the EPSS score is < 1%, indicating moderate severity but a very low probability of exploitation in the current landscape. The vulnerability is not listed in CISA’s KEV catalog. The attack requires an attacker to use an account with Author or higher permissions to insert the malicious attribute, after which any user who opens the post receives the executed script.