CVE-2025-3098 is a reflected cross-site scripting vulnerability (CWE-79) in the ulshamim Video Url WordPress plugin affecting all versions up to 1.0.0.3. The vulnerability occurs due to improper neutralization of input in the 'id' parameter, allowing injection of malicious scripts that execute in the context of a victim's browser when they click a crafted link. The vulnerability requires no privileges but does require user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impacts and no availability impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information or manipulation of web content. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to affected functionality. Avoid clicking on suspicious links that may exploit this vulnerability.