The vulnerability is an instance of improper neutralization of input during web page generation, allowing attackers to trigger reflected cross‑site scripting. This flaw can enable the injection of arbitrary JavaScript into the pages rendered by the plugin, which may lead to session hijacking, credential theft, defacement, or the execution of malicious scripts under the victim’s user context. The weakness is classified as CWE‑79, representing unsafe handling of user‑supplied data during output generation.

The affected product is LambertGroup Universal Video Player – Addon for WPBakery Page Builder, version 3.2.1 and earlier. WordPress installations that have not upgraded beyond 3.2.1 and are still using the WPBakery Page Builder framework are susceptible to this flaw.

The CVSS score of 7.1 indicates a high severity rating, yet the EPSS score is less than 1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the reflected XSS by crafting a malicious URL or form input that the plugin accepts and reflects back to the browser, typically requiring the victim to visit the injected link or page. Persistence is limited and no elevation of privilege is necessary, but the impact can be significant if the victim is an authenticated user.