CVE-2025-3098

Video Url <= 1.0.0.3 - Reflected Cross-Site Scripting

Published Apr 2, 2025 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Description

The Video Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.0.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Analysis

Technical impact

The Video Url WordPress plugin contains a reflected XSS flaw that allows arbitrary script injection via the 'id' query parameter. An unauthenticated attacker can craft a malicious link that, when visited by a user, causes the browser to execute the injected script in the context of the site.

Affected Systems

WordPress installations that have the Video Url plugin installed in any version up to and including 1.0.0.3 are affected. Sites running older releases that have not applied the fix remain vulnerable.

Risk and Exploitability

The CVSS base score is 6.1, indicating moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at present. This vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an unauthenticated user to click a crafted URL; no authentication or administrative privileges are needed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ulshamim

Video Url

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0.0.3

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Video Url plugin to the latest released version, removing the vulnerability.
If an immediate update is not possible, uninstall or disable the plugin to eliminate the attack vector.
As a temporary defense, implement input validation or sanitization on the 'id' parameter to ensure any reflected output is properly escaped.

Generated by OpenCVE AI on April 22, 2026 at 01:44 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-9545	The Video Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.0.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.354% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/video-sidebar-widget/tags/1.0.0.3/delete.php
https://plugins.trac.wordpress.org/browser/video-sidebar-widget/tags/1.0.0.3/video_edit.php
https://wordpress.org/plugins/video-sidebar-widget/
https://www.wordfence.com/threat-intel/vulnerabilities/id/587e28ea-b3f4-4e40-a7d2-c6a01ac905bf?source=cve

History

Apr 2, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 2, 2025 9:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Video Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.0.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title		Video Url <= 1.0.0.3 - Reflected Cross-Site Scripting
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/browser/video-sidebar-widget/tags/1.0.0.3/delete.php https://plugins.trac.wordpress.org/browser/video-sidebar-widget/tags/1.0.0.3/video_edit.php https://wordpress.org/plugins/video-sidebar-widget/ https://www.wordfence.com/threat-intel/vulnerabilities/id/587e28ea-b3f4-4e40-a7d2-c6a01ac905bf?source=cve
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`