A reflected cross-site scripting vulnerability in the LambertGroup Universal Video Player plugin for WPBakery Page Builder poses a risk of unauthorized script execution and session compromise.

This flaw is a reflected cross-site scripting (XSS) vulnerability caused by improper neutralization of user-supplied input during web page generation. An unauthenticated attacker can trigger this issue by tricking a user into clicking a crafted link, leading to malicious script execution within the context of the user's browser.

The exploitation of this vulnerability can result in the theft of session cookies, redirection to malicious websites, or unauthorized actions performed on behalf of an authenticated user. With a CVSS score of 7.1, this represents a high-severity risk that could lead to significant account takeover or data exposure within the affected WordPress environment.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the vendor website for security updates and apply them as soon as they become available.

Proactive Monitoring: Review web server access logs for anomalous URL parameters containing script tags or suspicious encoded characters that match typical XSS payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS protection rules to inspect and sanitize incoming HTTP requests before they reach the vulnerable plugin.

Public Exploit Available: Unknown

Given the potential for account compromise via reflected XSS, administrators should prioritize securing the environment by disabling the plugin if it is not business-critical until a vendor-supplied update is released. Ensure that all users are educated on the risks of clicking suspicious links, as this remains the primary delivery vector for this vulnerability.