The vulnerability arises from improper neutralization of user input during web page generation. An attacker can inject malicious JavaScript that is reflected back by the Universal Video Player‑Addon plugin. This results in a cross‑site scripting flaw (CWE‑79) that can be exploited to execute arbitrary code in the context of the victim’s browser, potentially leading to credential theft, session hijacking or defacement.

LambertGroup Universal Video Player – Addon for WPBakery Page Builder is affected. The flaw is present in all releases from the initial version up to and including 3.2.1. WordPress sites that have installed any of these versions of the plugin are vulnerable.

The CVSS score is 7.1, indicating medium‑to‑high risk. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, implying a low but non‑zero exploitation probability. Attackers would likely craft a crafted URL or form input containing malicious script that triggers the plugin to echo it back. If the target site is accessed by a victim, the injected script will run in the victim’s session, allowing theft of cookies or navigation to malicious sites. The attack scenario requires the target site to act upon the malicious input, so active exploitation is possible but not automatic.