The LambertGroup Universal Video Player plugin is vulnerable to a reflected cross-site scripting attack, which could allow unauthenticated attackers to execute arbitrary scripts in a user's browser.

This is a reflected cross-site scripting (CWE-79) vulnerability caused by improper neutralization of user-supplied input during web page generation. An unauthenticated attacker can craft a malicious URL to execute scripts within the context of the victim's session.

This vulnerability carries a CVSS score of 7.1, indicating a high severity risk. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of the user, or the exfiltration of sensitive information, potentially resulting in significant reputational damage and data compromise.

Immediate Action: Users should check the official LambertGroup support channels or the WPBakery marketplace for the latest security update and apply it immediately. If no update is currently available, consider disabling the plugin until a patch is released.

Proactive Monitoring: Security teams should monitor web server access logs for requests containing suspicious script tags or encoded characters in URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common cross-site scripting patterns directed at the plugin's endpoints.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score, organizations using this addon should treat this as a priority item. Administrators must verify their current installation version and prepare for an immediate update once the vendor releases a fix. Until a patch is confirmed, limiting access to the affected site or utilizing a WAF is essential to mitigate the risk of exploitation.