The vulnerability CVE-2025-27308 in cmstactics WP Video Posts plugin (versions <= 3.5.1) is a reflected cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute when a user interacts with crafted content, potentially leading to information disclosure, data manipulation, or service disruption. The CVSS v3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in execution of arbitrary scripts in the victim's browser, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system or user data. Since it is a reflected XSS, the attacker must convince a user to interact with a malicious link or content. There are no known exploits in the wild currently.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory channels for updates and apply any official patches once available. Until then, consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts targeting this plugin. Avoid clicking on suspicious links that may exploit this vulnerability.