What is the CVSS score of CVE-2025-31057?

CVE-2025-31057 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-31057?

A cross-site scripting (XSS) vulnerability in LambertGroup Universal Video Player (versions through 1.4.0) could allow attackers to inject malicious code through crafted URLs, potentially…

How to fix or mitigate CVE-2025-31057?

Within 24 hours: Inventory all systems running Universal Video Player and restrict access to trusted users only. Within 7 days: Deploy WAF rules to block XSS payloads targeting the vulnerable video player endpoints, and consider disabling the player until patched. Within 30 days: Contact LambertGroup for patch availability, evaluate alternative video players, or implement strict input validation and Content Security Policy (CSP) headers as long-term controls.

Wordpress Plugin CVE-2025-31057

EUVD-2025-17494 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-09 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17494

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player allows Reflected XSS. This issue affects Universal Video Player: from n/a through 1.4.0.

AnalysisAI

Reflected Cross-Site Scripting (XSS) vulnerability in LambertGroup Universal Video Player versions up to 1.4.0 that allows unauthenticated attackers to inject malicious scripts into web pages viewed by users. The vulnerability has a CVSS score of 7.1 (High) with a network-based attack vector requiring user interaction. While the exact EPSS and KEV status cannot be confirmed from provided data, the reflected XSS classification and accessible attack surface suggest moderate-to-high real-world exploitation likelihood, particularly if POC code becomes available.

Technical ContextAI

The vulnerability exists in LambertGroup Universal Video Player (CPE likely: cpe:2.3:a:lambertgroup:universal_video_player:*:*:*:*:*:*:*:*), a web-based video playback component. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating insufficient input sanitization or output encoding when the player processes user-supplied parameters (likely URL parameters or embed attributes). The player fails to neutralize malicious script content before rendering it into the HTML DOM, allowing attackers to inject arbitrary JavaScript code. This is a client-side vulnerability occurring during page generation/rendering, not server-side injection, making it a 'Reflected' XSS attack vector where payloads are typically embedded in URLs or crafted requests.