This vulnerability in kwiliarty's External Video For Everybody plugin allows an attacker to inject and store malicious scripts due to improper input sanitization during web page generation. When a victim views the affected content, the stored script executes in their browser context, potentially leading to information disclosure, session hijacking, or other impacts consistent with stored XSS. The vulnerability affects all versions up to 2.1.1. The CVSS vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with impact on confidentiality, integrity, and availability at a low level.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other malicious actions. The impact is rated as medium severity with partial confidentiality, integrity, and availability impacts. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding workarounds if feasible. Monitor vendor channels for updates and apply patches promptly once released.