---METADATA---
VENDOR: LambertGroup
PRODUCT: Image&Video FullScreen Background
AFFECTED_VERSIONS: 0 through 1.6.7
CONFIDENCE: high
MISSING: patch
CREDITS: João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program (finder)
SOURCES_JSON: [{"url":"https://patchstack.com/database/Wordpress/Plugin/lbg_fullscreen_fullwidth_slider/vulnerability/wordpress-image-video-fullscreen-background-plugin-1-6-7-sql-injection-vulnerability?_s_id=cve","name":null,"tags":["vdb-entry"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.858Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the Image&Video FullScreen Background WordPress plugin allows authenticated attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in the LambertGroup Image&Video FullScreen Background plugin allows authenticated attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-62093

Affected Software: LambertGroup Image&Video FullScreen Background

Affected Versions: 0 through 1.6.7

Vulnerability: This vulnerability involves improper neutralization of special elements used in SQL commands within the lbg_fullscreen_fullwidth_slider component. The CVSS vector indicates that this flaw is accessible to authenticated users with low privileges.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive database information. Given the CVSS score of 8.5, this high-severity flaw poses a significant risk to data confidentiality and potentially system availability, which may result in severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Since a specific patch is not currently confirmed, administrators should immediately deactivate or uninstall the Image&Video FullScreen Background plugin until a secure version is released by the vendor.

Proactive Monitoring: Security teams should review database query logs for anomalous patterns or unauthorized access attempts originating from the plugin's associated endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SQL injection remains a high-risk vector that should be addressed promptly through defensive configuration and software lifecycle management.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to protect the underlying database environment. Administrators must prioritize the deactivation of the affected plugin until the vendor provides a verified security update, as this remains the most effective method to mitigate the risk of unauthorized data exposure.

---METADATA---
VENDOR: LambertGroup
PRODUCT: AllInOne - Content Slider
AFFECTED_VERSIONS: 0 through 3.8
CONFIDENCE: high
MISSING: patch
CREDITS: João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program (finder)
SOURCES_JSON: [{"url":"https://patchstack.com/database/Wordpress/Plugin/all-in-one-contentSlider/vulnerability/wordpress-lambertgroup-allinone-content-slider-plugin-3-8-sql-injection-vulnerability?_s_id=cve","name":null,"tags":["vdb-entry"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:41.414Z
---END_METADATA---

Description Summary:
The LambertGroup AllInOne - Content Slider plugin for WordPress is vulnerable to Blind SQL Injection, allowing an authenticated attacker to manipulate database queries.

Executive Summary:
A Blind SQL Injection vulnerability in the LambertGroup AllInOne - Content Slider plugin allows authenticated attackers to potentially exfiltrate sensitive data from the database.

Vulnerability Details

CVE-ID: CVE-2025-60109

Affected Software: LambertGroup AllInOne - Content Slider

Affected Versions: 0 through 3.8

Vulnerability: This flaw is a Blind SQL Injection (CWE-89) triggered by improper neutralization of special elements in SQL commands. The vulnerability requires the attacker to have at least low-level authenticated access to the system.

Business Impact

The ability to perform Blind SQL Injection poses a significant risk to data confidentiality, as attackers can extract information from the database through inference. Given the CVSS score of 8.5, this high-severity vulnerability could lead to unauthorized data disclosure and potential compromise of the underlying application integrity.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate or remove the AllInOne - Content Slider plugin until a security update is released by the vendor.

Proactive Monitoring: Review database error logs and query execution logs for unusual patterns, such as unexpected syntax errors or high volumes of time-based query requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the WordPress environment.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 26, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for unauthorized data access, and users should prioritize reducing the attack surface by disabling the affected software.

Analyst Recommendation

Due to the high CVSS severity and the nature of SQL injection flaws, this vulnerability presents a substantial risk to organizational data. Organizations currently utilizing the LambertGroup AllInOne - Content Slider should prioritize its removal or deactivation until the vendor provides a verified security patch to remediate the underlying code vulnerability.

---METADATA---
VENDOR: LambertGroup
PRODUCT: AllInOne - Banner with Thumbnails
AFFECTED_VERSIONS: 0 through 3.8
CONFIDENCE: high
MISSING: patch
CREDITS: João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program (finder)
SOURCES_JSON: [{"url":"https://patchstack.com/database/Wordpress/Plugin/all-in-one-thumbnailsBanner/vulnerability/wordpress-lambertgroup-allinone-banner-with-thumbnails-plugin-3-8-sql-injection-vulnerability?_s_id=cve","name":null,"tags":["vdb-entry"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:41.414Z
---END_METADATA---

Description Summary:
The AllInOne - Banner with Thumbnails WordPress plugin is vulnerable to blind SQL injection, allowing an authenticated user to extract database information through improperly sanitized input parameters.

Executive Summary:
A blind SQL injection vulnerability in the LambertGroup AllInOne - Banner with Thumbnails plugin allows authenticated attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-60108

Affected Software: LambertGroup AllInOne - Banner with Thumbnails

Affected Versions: 0 through 3.8

Vulnerability: The software fails to properly neutralize special elements used in SQL commands, resulting in a blind SQL injection vulnerability (CWE-89). Based on the CVSS vector (PR:L), this flaw requires an authenticated user to trigger the malicious query.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive database content, potentially exposing user data or administrative credentials. Given the CVSS score of 8.5, this is a high-severity issue that threatens the confidentiality and stability of the underlying WordPress environment.

Remediation Plan

Immediate Action: As no official patch is currently confirmed, administrators should immediately deactivate and remove the AllInOne - Banner with Thumbnails plugin from their environments until a secure version is released by the vendor.

Proactive Monitoring: Security teams should review web server logs for suspicious database queries, particularly those containing SQL syntax characters or unexpected patterns originating from authenticated user sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a layer of virtual patching against potential exploitation attempts.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Analyst Notes: As of September 26, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for authenticated access limits the attack surface, but it remains a significant risk for environments with untrusted user accounts.

Analyst Recommendation

Given the high CVSS score and the potential for database compromise, this vulnerability poses a serious risk to organizational security. Administrators are strongly advised to prioritize the removal of the vulnerable software and monitor for any signs of unauthorized database interaction until the vendor provides a verified security update.

---METADATA---
VENDOR: LambertGroup
PRODUCT: AllInOne - Banner with Playlist
AFFECTED_VERSIONS: 0 through 3.8
CONFIDENCE: high
MISSING: patch
CREDITS: João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program (finder)
SOURCES_JSON: [{"url":"https://patchstack.com/database/Wordpress/Plugin/all-in-one-bannerWithPlaylist/vulnerability/wordpress-lambertgroup-allinone-banner-with-playlist-plugin-3-8-sql-injection-vulnerability?_s_id=cve","name":null,"tags":["vdb-entry"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:41.414Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the LambertGroup AllInOne - Banner with Playlist plugin allows authenticated attackers to perform blind SQL injection attacks.

Executive Summary:
A high-severity blind SQL injection vulnerability exists in the LambertGroup AllInOne - Banner with Playlist plugin, posing a significant risk of unauthorized database data exposure.

Vulnerability Details

CVE-ID: CVE-2025-60107

Affected Software: LambertGroup AllInOne - Banner with Playlist

Affected Versions: 0 through 3.8

Vulnerability: The plugin fails to properly neutralize special elements used in SQL commands, resulting in a blind SQL injection vulnerability. Based on the CVSS vector, this flaw requires the attacker to have low-level privileges (authenticated) to trigger the malicious query.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to extract sensitive information from the underlying database, potentially leading to unauthorized data disclosure. Given the CVSS score of 8.5, this high-severity flaw could facilitate credential theft or further compromise of the WordPress environment, resulting in significant operational and reputational damage.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, users should immediately deactivate and remove the AllInOne - Banner with Playlist plugin until a secure update is released by the vendor.

Proactive Monitoring: Review database query logs for unusual patterns or syntax errors that suggest automated injection attempts against the plugin's endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns until the vulnerable code is updated or removed.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of September 26, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently exploitable by authenticated users, making the restriction of user access to the administrative dashboard a critical temporary measure.

Analyst Recommendation

This vulnerability represents a high risk to the confidentiality of the database and requires immediate attention. Organizations utilizing the LambertGroup AllInOne - Banner with Playlist plugin should treat this as a high-priority incident and remove the affected component from their environment until the vendor provides a verified security update.

---METADATA---
VENDOR: LambertGroup
PRODUCT: Universal Video Player - Addon for WPBakery Page Builder
AFFECTED_VERSIONS: 0 through 3.2.1
CONFIDENCE: high
MISSING: patch, technical_details
CREDITS: 0xd4rk5id3 | Patchstack Bug Bounty Program (finder)
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:37.718Z
---END_METADATA---

Description Summary:
A reflected cross-site scripting vulnerability exists in the LambertGroup Universal Video Player plugin for WPBakery Page Builder, allowing for arbitrary script execution via malicious input.

Executive Summary:
The LambertGroup Universal Video Player plugin is vulnerable to a reflected cross-site scripting attack, which could allow unauthenticated attackers to execute arbitrary scripts in a user's browser.

Vulnerability Details

CVE-ID: CVE-2025-53559

Affected Software: LambertGroup Universal Video Player - Addon for WPBakery Page Builder

Affected Versions: 0 through 3.2.1

Vulnerability: This is a reflected cross-site scripting (CWE-79) vulnerability caused by improper neutralization of user-supplied input during web page generation. An unauthenticated attacker can craft a malicious URL to execute scripts within the context of the victim's session.

Business Impact

This vulnerability carries a CVSS score of 7.1, indicating a high severity risk. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of the user, or the exfiltration of sensitive information, potentially resulting in significant reputational damage and data compromise.

Remediation Plan

Immediate Action: Users should check the official LambertGroup support channels or the WPBakery marketplace for the latest security update and apply it immediately. If no update is currently available, consider disabling the plugin until a patch is released.

Proactive Monitoring: Security teams should monitor web server access logs for requests containing suspicious script tags or encoded characters in URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common cross-site scripting patterns directed at the plugin's endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for client-side code execution, though it requires user interaction to successfully trigger the payload.

Analyst Recommendation

Given the high CVSS score, organizations using this addon should treat this as a priority item. Administrators must verify their current installation version and prepare for an immediate update once the vendor releases a fix. Until a patch is confirmed, limiting access to the affected site or utilizing a WAF is essential to mitigate the risk of exploitation.

---METADATA---
VENDOR: LambertGroup
PRODUCT: Revolution Video Player With Bottom Playlist
AFFECTED_VERSIONS: 0 through 2.9.2
CONFIDENCE: high
MISSING: patch
CREDITS: João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program (finder)
SOURCES_JSON: [{"url":"https://patchstack.com/database/Wordpress/Plugin/revolution-video-player/vulnerability/wordpress-revolution-video-player-with-bottom-playlist-2-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve","name":null,"tags":["vdb-entry"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:37.718Z
---END_METADATA---

Description Summary:
A reflected cross-site scripting (XSS) vulnerability exists in the LambertGroup Revolution Video Player plugin, allowing attackers to inject malicious scripts via unsanitized input.

Executive Summary:
A reflected XSS vulnerability in the LambertGroup Revolution Video Player plugin allows unauthenticated attackers to execute arbitrary scripts in the context of a user session.

Vulnerability Details

CVE-ID: CVE-2025-53212

Affected Software: LambertGroup Revolution Video Player With Bottom Playlist

Affected Versions: 0 through 2.9.2

Vulnerability: This is a reflected cross-site scripting (CWE-79) vulnerability occurring due to improper neutralization of input during web page generation. An unauthenticated attacker can trigger the execution of malicious scripts by tricking a user into interacting with a crafted URL.

Business Impact

The exploitation of this vulnerability could lead to session hijacking, unauthorized actions performed on behalf of authenticated users, or the redirection of visitors to malicious websites. With a CVSS score of 7.1, the risk is classified as High, reflecting the potential for significant disruption to site integrity and user trust despite the requirement for user interaction.

Remediation Plan

Immediate Action: Since no specific patch version is currently confirmed, administrators should disable or remove the Revolution Video Player With Bottom Playlist plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous request patterns or URL parameters containing script-like characters, such as