CVE-2025-7732

The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.18.7. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's JavaScript handlers. Specifically, the handlers read the client-supplied data-video-title and href attributes, decode HTML entities by default, and then directly pass the decoded content into DOM sinks without any escaping or validation [1].

An attacker must have at least Contributor-level access to the WordPress site to exploit this vulnerability. By injecting malicious JavaScript into the data-video-title or href attributes of plugin elements, the attacker can cause arbitrary web scripts to execute when any user views the affected page. No additional privileges or network position are required beyond authenticated access with Contributor capabilities [1].

Successful exploitation allows the attacker to inject and execute arbitrary scripts in the context of the victim's browser. This can lead to session hijacking, defacement, theft of sensitive information, or further compromise of the WordPress site. The impact is typical of stored XSS vulnerabilities, where the malicious payload persists across page loads and affects all visitors [1].

As of the publication date, users are advised to update the plugin to a patched version if available. The vendor may have released a fix addressing the input sanitization and output escaping issues. No workarounds are mentioned in the available reference, so updating is the primary mitigation [1].