CVE-2025-2484 is a reflected cross-site scripting vulnerability in the Multi Video Box plugin for WordPress affecting all versions up to 1.5.2. The vulnerability is due to improper neutralization of input in the 'video_id' and 'group_id' parameters, enabling injection of arbitrary web scripts. This can be exploited by unauthenticated attackers who trick users into clicking malicious links, potentially leading to script execution in the context of the affected site. The vulnerability has a CVSS 3.1 score of 6.1, reflecting medium severity with low complexity and no required privileges but requiring user interaction.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the vulnerable website for users who interact with crafted links. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of site content. There is no impact on availability. No known active exploitation has been reported.

No official patch or remediation has been documented yet for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted links involving the affected parameters and consider disabling or replacing the plugin if possible.