The flaw is an improper neutralization of user input that permits reflected cross‑site scripting in the LambertGroup Youtube Vimeo Video Player and Slider WP Plugin. An attacker can craft a malicious URL or input that, when processed by the plugin, injects arbitrary JavaScript into the browser of a user who views the page. The vulnerability is rated CVSS 7.1 and matches CWE‑79, indicating the risk of untrusted data influencing page rendering, which can lead to credential theft, defacement, or other client‑side exploits. The impact is limited to the session of the victim user but can affect multiple visitors if the page is widely shared.

Vendors and products targeted are LambertGroup’s Youtube Vimeo Video Player and Slider WP Plugin. All releases up to and including version 3.8 are affected; no further sub‑versions are listed.

Because the vulnerability is reflected, an attacker must first lure a victim to a manipulated URL or form field; no authentication or privileged access is required. The EPSS score is below 1%, suggesting that widespread exploitation is currently unlikely, and the vulnerability is not included in CISA’s Known Exploited Vulnerabilities catalog. Nonetheless, the CVSS of 7.1 signals moderate severity, and the attack vector is via user interaction, making vigilance and timely patching important.