The Responsive Video Embedder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the 'rem_video' shortcode's 'id' and 'list' attributes are not properly sanitized or escaped before being concatenated into an iframe's src attribute in the video_shortcode() function. This allows authenticated users with contributor-level privileges or higher to inject arbitrary JavaScript that executes in the context of any user viewing the compromised page. The vulnerability affects versions up to 0.1 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). There is no vendor-provided patch or official remediation at this time, and no known active exploitation has been reported.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages via the vulnerable shortcode attributes. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content when other users access the infected pages. There is no impact on availability. The vulnerability requires authenticated access with contributor privileges or above, which limits the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only. Consider disabling or removing the Responsive Video Embedder plugin if it is not essential. Monitor for updates from the vendor regarding patches or mitigations.