Executive brief
Featured Video Plus is a popular WordPress plugin that displays videos on website pages. A cross-site scripting (XSS) vulnerability in versions up to 2.3.3 allows attackers with contributor-level access to inject malicious scripts that can steal visitor data or hijack visitor accounts when those scripts are viewed by site visitors.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Featured Video Plus plugin version 2.3.3 and earlier. The vulnerability allows authenticated users with contributor-level privileges to inject arbitrary JavaScript code into the plugin's data fields. The injected payload is stored in the database and later reflected to other site visitors without proper sanitization or escaping, allowing attackers to steal session cookies, perform actions on behalf of visitors, or redirect users to malicious sites. User interaction is required—visitors must view a page or component containing the attacker's malicious script. As of the advisory date, no official patch from the plugin developers is available; mitigation requires updating to a patched version or disabling the plugin.
Affected products
- Featured Video Plus Featured Video Plus <= 2.3.3
Timeline
- 2026-07-09: disclosed: Vulnerability reported to Patchstack by Ananda Dhakal
- 2026-08-18: advisory: Published by Patchstack