The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with editor-level or higher permissions can inject arbitrary web scripts via plugin settings. These scripts are stored and executed when users visit the injected pages. The vulnerability affects all versions up to 2.7.11 and is limited to multi-site installations or those where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring privileges but no user interaction. No patch or remediation details are currently available.

An attacker with editor-level or higher privileges can inject persistent malicious scripts into pages via plugin settings. These scripts execute in the context of users visiting the affected pages, potentially leading to information disclosure or session hijacking. The impact is limited by the requirement for authenticated access with elevated permissions and the specific installation conditions (multi-site or unfiltered_html disabled). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level permissions to trusted users only and consider disabling or limiting the use of the affected plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates or patches addressing this vulnerability.