The LambertGroup Universal Video Player contains a reflected XSS vulnerability due to improper input neutralization during web page generation. This affects versions up to 3.8.3. The vulnerability allows attackers to inject malicious scripts that execute when a user interacts with crafted content, potentially compromising user data and application behavior. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of user credentials, session tokens, or other sensitive information, as well as manipulation of the user interface or redirection to malicious sites. The CVSS vector indicates partial impacts on confidentiality, integrity, and availability. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content in affected versions of Universal Video Player. Monitor vendor channels for updates and apply patches promptly once released.