CVE-2025-8072

The Target Video Easy Publish plugin for WordPress, in all versions up to and including 3.8.8, contains a stored cross-site scripting (XSS) vulnerability in the placeholder_img parameter. The plugin fails to properly sanitize user-supplied input and escape output when rendering the parameter, enabling the injection of arbitrary HTML and JavaScript code [1].

Exploitation requires an authenticated user with at least Contributor-level permissions. The attacker can inject malicious scripts via the placeholder_img parameter, which are then stored on the server and executed whenever a victim visits a page containing the injected content. No special network position is required beyond regular WordPress contributor access.

Successful exploitation allows the attacker to execute arbitrary web scripts in the context of the victim's browser session. This can lead to session hijacking, defacement of the affected site, redirection to malicious domains, or theft of sensitive information such as authentication cookies.

The vulnerability has been addressed in a patched version of the plugin. Users are strongly advised to update to the latest version available from the WordPress plugin repository [1].