This vulnerability involves improper neutralization of input in the LambertGroup - AllInOne - Banner with Thumbnails plugin, leading to reflected cross-site scripting (XSS). Versions up to and including 3.8 are affected. The CVSS 3.1 base score is 7.1, indicating a high-severity issue with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation of this reflected XSS vulnerability can allow an attacker to execute arbitrary scripts in the context of a user's browser session, potentially leading to theft of user data, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability to a limited degree. The CVSS vector indicates that user interaction is required and the attack can be performed remotely without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding workarounds if feasible, and avoid exposing vulnerable versions in untrusted contexts. Monitor vendor channels for updates.