This vulnerability (CVE-2025-39409) involves improper neutralization of input in the 'Video Robot - The Ultimate Video Importer' WordPress plugin by pressaholic, classified under CWE-79 (Cross-site Scripting). It affects all versions up to 1.20.0. The flaw allows an attacker to inject malicious scripts into web pages generated by the plugin, potentially impacting confidentiality, integrity, and availability of affected sites. The CVSS 3.1 base score is 7.1, reflecting a high severity with network attack vector and user interaction required. No patch or official fix has been published, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to data disclosure, modification, or disruption of service. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.