This vulnerability (CVE-2025-48159) affects the LambertGroup Youtube Vimeo Video Player and Slider WP Plugin (versions <= 3.8) and is caused by improper neutralization of input during web page generation, resulting in a reflected Cross-site Scripting (XSS) flaw. The CVSS 3.1 base score is 7.1 (high), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated low to low. The plugin does not operate as a cloud service, and no patch or mitigation guidance is currently provided.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system or user data. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to mitigate risk. Avoid clicking on suspicious links that could trigger reflected XSS payloads. Monitor for updates from LambertGroup regarding patches or temporary fixes.