Administrator-context script execution via unsanitized player settings

Stored cross-site scripting in bPlugins HTML5 Video Player before 2.5.19 allows remote authenticated users to run script in an administrator's browser. The h5vp_import_data AJAX action stores attacker-controlled h5vp_total_views content without a capability check or sanitization, and the player-list view outputs the value without escaping. Subscriber access is sufficient to plant the payload, but execution requires a high-privilege user to open the player list; the script then runs in that user's browser context.