The Able Player WordPress plugin suffers from a stored XSS vulnerability due to improper neutralization of input in the 'preload' parameter. This allows authenticated users with Contributor or higher privileges to inject malicious scripts that persist in the application and execute in the context of other users viewing the affected pages. The vulnerability affects all versions up to 1.2.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an attacker with Contributor-level access or above to execute arbitrary JavaScript in the context of other users visiting the injected pages. This can lead to information disclosure and integrity violations within the affected WordPress site. There is no direct impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider additional input validation or output encoding controls at the application level to mitigate risk.