CVE-2025-48170: WordPress Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder allows Reflected XSS. This issue affects Universal Video Player - Addon for WPBakery Page Builder: from n/a through 3.2.1.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder lbg-universal-video-player-addon-visual-composer allows Reflected XSS.This issue affects Universal Video Player - Addon for WPBakery Page Builder: from n/a through <= 3.2.1.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48170?
CVE-2025-48170 has a medium severity rating due to its potential to exploit reflected cross-site scripting (XSS) vulnerabilities.
How do I fix CVE-2025-48170?
To fix CVE-2025-48170, update the Universal Video Player - Addon for WPBakery Page Builder to version 3.2.2 or higher.
What systems are affected by CVE-2025-48170?
CVE-2025-48170 affects the Universal Video Player - Addon for WPBakery Page Builder versions up to and including 3.2.1.
Can CVE-2025-48170 be exploited remotely?
Yes, CVE-2025-48170 can be exploited remotely as it allows injection of malicious scripts via user input.
What are the potential impacts of exploiting CVE-2025-48170?
Exploiting CVE-2025-48170 can lead to unauthorized access to user data and website content manipulation through reflected XSS.