Stored Cross-Site Scripting in Lazy Load for Videos Plugin by WordPress

CVE-2025-7732

What is CVE-2025-7732?

The Lazy Load for Videos plugin for WordPress has a vulnerability that allows authenticated users, with Contributor-level and higher access, to perform stored Cross-Site Scripting (XSS) attacks. This is due to inadequate input sanitization and output escaping mechanisms in the plugin's lazy-loading handlers. Specifically, the plugin directly uses the 'data-video-title' and 'href' attributes from client input after decoding HTML entities, allowing injected JavaScript code to execute in the user's browser when they visit the compromised pages. Mitigation requires immediate updates to the plugin and practices for validating input and sanitizing output.

References