Input validation vulnerability in WP-Player 2.6.1

The WP-Player plugin used in WordPress is at risk for a type of cyber attack called Stored Cross-Site Scripting. This can happen in any version up to 2.6.1 because the plugin does not properly clean up the information that is entered and displayed. This means that someone with contributor-level access or higher can insert malicious code into a page, which will then be executed whenever someone views that page.