The vulnerability CVE-2025-26583 in videowhisper Video Share VOD (<= 2.7.9) is a reflected Cross-site Scripting (XSS) issue caused by improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that are reflected back to users, potentially impacting confidentiality, integrity, and availability. The CVSS v3.1 score is 7.1 (high), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and partial impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can allow attackers to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of the affected system. The scope is changed, indicating that the vulnerability can affect resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, applying input validation and output encoding where possible may reduce risk. No vendor advisory states that no action is required or that the issue is already mitigated.