Cross-Site Request Forgery Vulnerability in Video Share VOD Plugin by WordPress

CVE-2025-7812

What is CVE-2025-7812?

The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability across all versions up to and including 2.7.6. This flaw arises from inadequate nonce validation within the adminExport() function. By leveraging this vulnerability, an unauthenticated attacker could potentially manipulate site settings and execute remote code when the Server command execution feature is enabled. This is achievable if a site administrator is deceived into clicking on a malicious link, allowing the attacker to execute unauthorized actions.

References