The Multi Video Box plugin for WordPress contains a reflected XSS flaw in the "video_id" and "group_id" parameters. The vulnerability arises from insufficient input sanitization and output escaping, allowing an attacker to inject arbitrary JavaScript that runs in the browser of any user who follows a crafted link. This can lead to session hijacking, credential theft, or defacement of the site. The weakness is classified as CWE‑79, a common injection issue where malicious code can be reflected back to the user without proper filtering.

The flaw affects the skustes Multi Video Box plugin in all releases up to and including version 1.5.2. Users running these or earlier releases are exposed to the risk.

The CVSS score of 6.1 indicates a moderate impact, and the EPSS score of less than 1% suggests that exploitation is currently unlikely but possible. The attack requires an unauthenticated user to click a malicious link, which is a typical user‑interaction scenario for reflected XSS. The vulnerability is not listed in CISA’s KEV catalog, and no official patch or workaround is currently provided by the vendor.