The FitVids for WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject arbitrary scripts through the plugin's admin settings, which are then stored and executed when users access the affected pages. This issue affects all versions up to 4.0.1 and is limited to multi-site installations or those with unfiltered_html disabled. The vulnerability requires high privileges (administrator) and has a CVSS 3.1 base score of 4.4, reflecting medium severity with network attack vector, high attack complexity, and no user interaction required.

An attacker with administrator-level permissions can inject malicious scripts that execute in the context of users visiting the injected pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or modification of displayed content. The vulnerability does not affect availability and requires high privileges to exploit. It is limited to specific WordPress configurations (multi-site or unfiltered_html disabled). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, restrict administrator access to trusted users only and consider disabling or removing the FitVids plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply official fixes once available.