The vulnerability CVE-2025-32536 affects the HTML5 Video Player with Playlist developed by Sandeep Verma. It is a reflected cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation. This allows an attacker to inject and execute arbitrary scripts in the context of the victim's browser session. The affected versions are from initial releases through version 2.50. The CVSS 3.1 base score is 7.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and partial impact to confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to partial disclosure of information, modification of data, and disruption of service. The reflected XSS nature requires user interaction. The scope change in the CVSS vector indicates that the vulnerability can affect resources beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on their own if possible, or restrict usage of affected versions. Monitor vendor channels for updates regarding patches or official mitigations.