Cross-Site Scripting Vulnerability in WordPress Video Robot by Pressaholic
CVE-2025-39409

7.1HIGH

Key Information:

Vendor

WordPress
Status
WordPress Video Robot - The Ultimate Video Importer
Vendor
CVE Published:
19 May 2025

What is CVE-2025-39409?

The cross-site scripting vulnerability in WordPress Video Robot - The Ultimate Video Importer allows attackers to inject malicious scripts via improperly sanitized input during web page generation. This issue can compromise the security of affected websites, potentially leading to data exposure and unauthorized access. Users of the impacted versions should promptly apply the necessary updates to safeguard their sites against exploitation.

Affected Version(s)

WordPress Video Robot - The Ultimate Video Importer <= 1.20.0

References

https://patchstack.com/database/wordpress/plugin/wp-video...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bonds (Patchstack Alliance)
.