The Video Onclick WordPress plugin (tigor4eg) versions up to 0.4.7 contain a stored Cross-Site Scripting vulnerability (CWE-79) in the youtube shortcode. This vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 score of 6.4, reflecting medium severity with potential confidentiality and integrity impacts but no availability impact. No patches or vendor advisories are currently available, and no known exploits have been reported.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the youtube shortcode. These scripts execute in the browsers of users who view the compromised pages, potentially leading to unauthorized actions such as session hijacking or data theft. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's channels for updates or advisories. As a temporary mitigation, restrict contributor-level access to trusted users only and consider disabling or removing the Video Onclick plugin until a fix is released. Review and sanitize any user-generated content involving the youtube shortcode to prevent injection of malicious scripts.