CVE-2025-7732
Published
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lazy‑loading handlers in all versions up to, and including, 2.18.7 due to insufficient input sanitization and output escaping. The plugin’s JavaScript registration handlers read the client‑supplied 'data-video-title' and 'href' attributes, decode HTML entities by default, and pass them directly into DOM sinks without any escaping or validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
<p>This plugin improves page load time and increases your Google PageSpeed Score. It works with oEmbed and replaces embedded Youtube and Vimeo videos with a clickable preview image.<br />
By loading videos only when the user clicks on the preview image, no unnecessary JavaScript is loaded. Especially on sites with many embedded videos this will make your visitors happy. Additionally, all Youtube videos are loaded in a privacy-enhanced mode using the “https://www.youtube-nocookie.com” embed URL.</p>
<p>This plugin works for your existing YouTube and Vimeo blocks. No vendor lock-in and no custom shortcodes: Easily turn the plugin on and off anytime.</p>
<p>Plugin review with speed test results <a href="https://wptavern.com/speed-up-wordpress-with-lazy-load-for-videos" rel="nofollow ugc">on WP Tavern</a>.<br />
Developers can contribute <a href="https://github.com/kevinweber/lazy-load-for-videos" rel="nofollow ugc">on Github</a>.<br />
More about the author <a href="https://www.kweber.com" rel="nofollow ugc">on kweber.com</a>.</p>
<h4>Some additional features:</h4>
<ul>
<li>Display video titles on preview images</li>
<li>Display privacy disclaimer on top of preview images (e.g. for GDPR compliance)</li>
<li>Pre-roll and post-roll advertisements: Convert all videos into a playlist and automatically add your corporate video, product teaser or another video advertisement to every video. (Great for branding and video ads!)</li>
<li>Hide annotations such as “subscribe to channel” to avoid distractions</li>
<li>Add custom CSS via the plugin’s admin panel</li>
<li>Choose custom colour for your Vimeo player</li>
<li>Hide controls from Youtube player</li>
<li>Hide information like the video title and uploader when the video starts playing</li>
<li>Even lazy load videos in text widgets (Youtube only)</li>
<li>Choose between thumbnail sizes (standard or cover)</li>
<li>Choose from several play button styles</li>
<li>Choose the traditional red or the alternative white progress bar for the Youtube video player</li>
<li>Don’t show related videos at the end of your videos</li>
<li>Works with WordPress Multisite and many plugins such as TablePress</li>
</ul>
<h4>Future features:</h4>
<ul>
<li>Set a custom preview image per video</li>
<li>Track how often the videos have been loaded with Google Analytics</li>
<li>… YOU want a new feature RIGHT NOW? Please implement it yourself and <a href="https://github.com/kevinweber/lazy-load-for-videos" rel="nofollow ugc">contribute on Github</a>, and I’ll publish your enhancements to the official WordPress directory.</li>
</ul>
<h4>Translators</h4>
<ul>
<li>Serbian (sr_RS) – <a href="//firstsiteguide.com/" rel="nofollow ugc">Ogi Djuraskovic</a></li>
<li>Spanish (es_ES) – <a href="http://po5i.github.io/" rel="nofollow ugc">Carlos Villavicencio</a></li>
</ul>
<p>If you have created your own language pack, or have an update of an existing one, you can <a href="https://www.kweber.com/contact/" rel="nofollow ugc">send me</a> your gettext PO and MO so that I can bundle it into my plugin. You can download the latest POT file <a href="https://plugins.svn.wordpress.org/lazy-load-for-videos/trunk/languages/lazy-load-for-videos.pot" rel="nofollow ugc">from here</a>.</p>
WordPress Plugin Directory