Improper neutralization of input in the Universal Video Player plugin allows an attacker to inject malicious JavaScript that is reflected back in the web page. The injected script executes in the context of any visitor’s browser, enabling session hijacking, defacement, or the delivery of further payloads. The flaw is a classic reflected XSS weakness (CWE‑79).

The vulnerability affects all installations of the Universal Video Player plugin from its earliest releases through version 3.8.3. The plugin is distributed by LambertGroup. Any WordPress site that has this plugin installed and has been configured to accept user input for its video or audio settings is potentially impacted.

With a CVSS score of 7.1 the flaw is considered high severity. The EPSS score is less than 1 %, indicating that large‑scale exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a crafted URL or form submission that a victim clicks or submits, so no privileged access is needed. An attacker can compromise the browser session of any user who views the compromised page.