This vulnerability (CVE-2025-31744) in the wpszaki Lightweight and Responsive Youtube Embed plugin allows stored cross-site scripting due to improper input neutralization during web page generation. It affects versions up to 1.0.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and partial impact on confidentiality, integrity, and availability. No patch or vendor advisory information is currently available, and no known exploits exist in the wild.

Successful exploitation could allow an attacker with low privileges to inject malicious scripts that execute in the context of users viewing the affected web pages, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system or user data. The impact is rated medium severity per the CVSS score of 6.5. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting privileges for users who can input data into the plugin and apply any available input validation or sanitization workarounds. Monitor official vendor channels for updates or patches addressing this vulnerability.