This vulnerability (CVE-2025-48154) involves improper neutralization of input in the Multimedia Playlist Slider Addon for WPBakery Page Builder by LambertGroup, specifically in the lbg_vp_youtube_vimeo_addon_visual_composer component. It allows reflected Cross-site Scripting (XSS) attacks, which can be triggered when malicious input is reflected in web pages without proper sanitization. The affected versions are from initial releases through version 2.1 inclusive. The CVSS 3.1 vector indicates a network attack vector with low complexity, no privileges required, but requires user interaction, and it affects confidentiality, integrity, and availability to a low degree. No patch or official remediation guidance is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The reflected XSS nature means the attack requires user interaction, such as clicking a crafted link. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected addon if feasible, or apply web application firewall (WAF) rules to detect and block reflected XSS attempts targeting this component. Monitor LambertGroup communications for updates and apply patches promptly once available.