CVE-2025-7732

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7732", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-16T22:56:22.532Z", "datePublished": "2025-08-27T01:46:48.673Z", "dateUpdated": "2026-04-08T17:11:33.178Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:33.178Z"}, "affected": [{"vendor": "kevinweber", "product": "Lazy Load for Videos", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.18.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lazy\u2011loading handlers in all versions up to, and including, 2.18.7 due to insufficient input sanitization and output escaping. The plugin\u2019s JavaScript registration handlers read the client\u2011supplied 'data-video-title' and 'href' attributes, decode HTML entities by default, and pass them directly into DOM sinks without any escaping or validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Lazy Load for Videos <= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9d28bd7d-ad3f-4720-9e09-466169fc672b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lazy-load-for-videos/trunk/public/js/lazyload-youtube.js"}, {"url": "https://plugins.trac.wordpress.org/browser/lazy-load-for-videos/trunk/public/js/lazyload-vimeo.js"}, {"url": "https://wordpress.org/plugins/lazy-load-for-videos/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3348894"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-08-26T12:22:01.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-27T14:09:07.751875Z", "id": "CVE-2025-7732", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-27T14:09:12.900Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7732", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-27T14:09:07.751875Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-27T14:09:10.616Z"}}], "cna": {"title": "Lazy Load for Videos <= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "kevinweber", "product": "Lazy Load for Videos", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.18.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-26T12:22:01.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9d28bd7d-ad3f-4720-9e09-466169fc672b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lazy-load-for-videos/trunk/public/js/lazyload-youtube.js"}, {"url": "https://plugins.trac.wordpress.org/browser/lazy-load-for-videos/trunk/public/js/lazyload-vimeo.js"}, {"url": "https://wordpress.org/plugins/lazy-load-for-videos/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3348894"}], "descriptions": [{"lang": "en", "value": "The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lazy\u2011loading handlers in all versions up to, and including, 2.18.7 due to insufficient input sanitization and output escaping. The plugin\u2019s JavaScript registration handlers read the client\u2011supplied 'data-video-title' and 'href' attributes, decode HTML entities by default, and pass them directly into DOM sinks without any escaping or validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:33.178Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7732", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:11:33.178Z", "dateReserved": "2025-07-16T22:56:22.532Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-27T01:46:48.673Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Lazy Load for Videos", "vendor": "kevinweber", "versions": [{"lessThanOrEqual": "2.18.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lazy\u2011loading handlers in all versions up to, and including, 2.18.7 due to insufficient input sanitization and output escaping. The plugin\u2019s JavaScript registration handlers read the client\u2011supplied 'data-video-title' and 'href' attributes, decode HTML entities by default, and pass them directly into DOM sinks without any escaping or validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Lazy Load for Videos para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de sus controladores de carga diferida en todas las versiones hasta la 2.18.7 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Los controladores de registro JavaScript del plugin leen los atributos \"data-video-title\" y \"href\" proporcionados por el cliente, decodifican las entidades HTML por defecto y las pasan directamente a los receptores DOM sin escape ni validaci\u00f3n. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-7732", "lastModified": "2026-06-17T10:05:33.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7732", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-27T14:09:07.751875Z", "version": "2.0.3"}}]}, "published": "2025-08-27T03:15:38.367", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/lazy-load-for-videos/trunk/public/js/lazyload-vimeo.js"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/lazy-load-for-videos/trunk/public/js/lazyload-youtube.js"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3348894"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/lazy-load-for-videos/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9d28bd7d-ad3f-4720-9e09-466169fc672b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:21:26.495474+00:00", "value": {"mitigation_remediation": ["Upgrade Lazy Load for Videos to the latest available version that removes the vulnerable code.", "If no update is available, temporarily disable or uninstall the plugin to block the exploitation path.", "Review and limit Contributor or higher roles, ensuring only trusted users can add or edit content that passes through the plugin."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All WordPress sites running the Lazy Load for Videos plugin by Kevin Weber, in all released versions up to and including 2.18.7. Any installation where contributors have write access to embed videos is susceptible.", "description_and_impact": "The Lazy Load for Videos plugin is vulnerable to a stored XSS flaw that allows an authenticated contributor or higher to inject malicious script code via the 'data-video-title' and 'href' attributes. Once supplied by the attacker, the plugin decodes HTML entities and writes the raw strings into the page without escaping, causing the script to run for every user who views the affected page. This flaw enables the attacker to manipulate the browser context of other users, potentially leading to session hijacking, defacement, or credential theft.", "risk_and_exploitability": "The CVSS score of 6.4 indicates medium severity based on integrity impacts, while the EPSS score is under 1%, suggesting a low but non\u2011zero likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog, implying no confirmed widespread attacks. Nevertheless, because only Contributor\u2011level access is required, many users in a typical WordPress environment can exploit the flaw. An attacker may inject the malicious code by adding or editing a post, page, or media item that includes the vulnerable attributes; the embedded script will then execute for all visitors who load the page."}}}}, "created": "2025-08-27T11:21:25.037447+00:00", "updated": "2026-04-21T03:30:26.331990+00:00", "vendors": ["kevinweber", "kevinweber$PRODUCT$lazy_load_for_videos", "wordpress", "wordpress$PRODUCT$wordpress"]}