Stored XSS Vulnerability in Video Gallery Plugin by Origincode

CVE-2025-48349

What is CVE-2025-48349?

A vulnerability has been discovered in the Video Gallery – Vimeo and YouTube Gallery plugin developed by Origincode, allowing for stored cross-site scripting (XSS) attacks. This security flaw enables attackers to inject malicious scripts into web pages viewed by users, potentially compromising the integrity and confidentiality of sensitive data. The issue impacts installations of the plugin from its initial release up to version 1.1.7, suggesting that users of earlier and the current version are at risk and should take immediate precautions.

References