Lazy Load for Videos EUVD-2026-109723

Exploitation requires an authenticated account with at least low privileges on the target WordPress site (CVSS PR:L), consistent with a user able to submit content the plugin stores, plus victim interaction (UI:R) - a user, typically an administrator or editor, must view the page where the stored payload renders for the script to fire. The site must run Lazy Load for Videos at a version up to and including 2.18.11. The exact injectable feature, parameter, or configuration is not described in the available sources. Limiting factors that reduce real-world risk: the attacker cannot be fully unauthenticated, the payload only triggers when another user loads the affected content, and impact is confined to the browser context of the viewing user (scope-changed, limited C/I/A).

This is a mid-severity Stored Cross-Site Scripting flaw (CWE-79) in the 'Lazy Load for Videos' WordPress plugin, scored CVSS 6.5. The supplied CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation that requires some authenticated privilege (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting that the injected script executes in another user's browser context. No CISA KEV listing is present, so there is no confirmed active exploitation; no EPSS score was provided, so exploitation probability cannot be quantified from this data. The only reference is the Patchstack vulnerability-database advisory, which is a disclosure record rather than verified working exploit code, so no public exploit is identified at time of analysis. The vendor-independent priority signal is 'this_month' (not act_now/emergency), which is consistent with a privilege- and interaction-gated stored XSS in a plugin rather than an urgent, wormable flaw. Net assessment: a genuine but not emergency-level issue - real where the plugin is installed and lower-privileged users can submit content, but gated by authentication and required interaction, so it is a scheduled-patch priority rather than a drop-everything one.

An attacker holding a low-privilege authenticated account (e.g., contributor-level) on a WordPress site running Lazy Load for Videos ≤2.18.11 submits content containing a malicious script payload that the plugin stores and later renders without proper neutralization. When a higher-privileged user such as an administrator views the affected page in the dashboard or front end, the stored script executes in their browser, enabling session or account actions in that context. No verified public exploit code was identified; the Patchstack advisory is the sole reference.