This vulnerability in nicashmu Post Video Players (<= 1.163) is a Stored Cross-site Scripting (XSS) flaw caused by improper input neutralization during web page generation. An attacker with high privileges can inject malicious scripts that are stored and later executed in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 5.9, reflecting network attack vector, low attack complexity, required high privileges, required user interaction, and a scope change.

Successful exploitation can lead to execution of malicious scripts in the context of affected users, potentially exposing sensitive information, modifying content, or causing denial of service. The impact is limited by the requirement for high privileges and user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict high privilege access to the plugin and limit user interactions that could trigger the vulnerability. Monitor vendor channels for updates and apply official fixes once released.