This vulnerability (CVE-2025-47666) affects LambertGroup's Image&Video FullScreen Background plugin up to version 1.6.7. It is caused by improper input neutralization during web page generation, resulting in a reflected Cross-site Scripting (XSS) flaw. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vulnerability allows attackers to inject malicious scripts that execute in users' browsers when they visit a crafted URL or page. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation of this reflected XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of affected users' sessions or data within the context of the vulnerable web application. Attackers may execute arbitrary scripts in victims' browsers, potentially leading to session hijacking, defacement, or other malicious actions. However, no known exploits have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding workarounds if possible. Monitoring for updates from LambertGroup is recommended to obtain an official patch or mitigation instructions.