CVE-2025-6539 is a stored cross-site scripting vulnerability (CWE-79) in the minutemedia Voltax Video Player WordPress plugin. The issue exists in the handling of the 'id' parameter, which lacks proper input sanitization and output escaping. Authenticated attackers with Contributor-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of users visiting the injected pages. This vulnerability affects all versions up to and including 1.6.5. The CVSS 3.1 score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact.

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to information disclosure and integrity issues within the affected WordPress site. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for suspicious activity related to script injection in the affected plugin. Avoid using the vulnerable versions of the Voltax Video Player plugin if possible.