The vulnerability is an improper neutralization of input during web page generation, allowing a reflected XSS flaw. An attacker can inject malicious script into the output page when a user visits a crafted URL. The script runs with the privileges of the victim’s browser session, potentially exfiltrating cookies, hijacking sessions, or defacing the site. The weakness is identified as CWE‑79.

LambertGroup – AllInOne – Banner with Playlist plugin for WordPress. Versions from the earliest released version up to and including 3.8 are impacted. No later versions were specified, so any installation of the plugin at or below 3.8 satisfies the affected range.

The CVSS score of 7.1 indicates moderate to high severity, with the low EPSS score of <1% suggesting limited exploitation activity. The vulnerability is not currently in CISA’s KEV catalog. The likely attack vector is web URL manipulation, as the flaw involves reflected input in the URL. Exploitation requires only a crafted link sent to a target user; no privileged access or remote code execution is necessary.