The LambertGroup Universal Video Player plugin contains a reflected XSS vulnerability in the elementor_widget_universal_video_player component. This occurs because input is not properly neutralized during web page generation, allowing attackers to inject and execute arbitrary scripts in the context of the victim's browser. The vulnerability affects all versions up to 1.4.0 inclusive. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, but requires user interaction. The impact includes partial confidentiality, integrity, and availability loss. No patch or vendor advisory is currently available.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected plugin version. Implementing web application firewall (WAF) rules to detect and block reflected XSS attempts may provide temporary mitigation. Avoid clicking on suspicious links that could trigger the vulnerability.