Cross-site scripting in wpdevart YouTube Embed, Playlist and Popup by WpDevArt
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wpdevart | YouTube Embed, Playlist and Popup by WpDevArt | up to 2.6.7 | — | No fix listed | CNA |
| denis-de-bernardy | Auto Thickbox | up to 3.5 | — | No fix listed | CNA |
| smub | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | up to 3.59.11 | — | No fix listed | CNA |
- YouTube Embed, Playlist and Popup by WpDevArt Vendorwpdevart Affected up to 2.6.7 Fixed in — No fix listed CNA
- Auto Thickbox Vendordenis-de-bernardy Affected up to 3.5 Fixed in — No fix listed CNA
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Vendorsmub Affected up to 3.59.11 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-2537
- 2026-10-03 Alias added: GHSA-m5fw-x833-hv4q
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/59ea7390-3587-4fce-b267-bf525dbe3e27?source=cve
- https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/static/Lightbox/thickbox/thickbox.js
- https://plugins.trac.wordpress.org/browser/youtube-video-player/trunk/front_end/scripts/youtube_embed_front_end.js
- https://plugins.trac.wordpress.org/browser/auto-thickbox/trunk/js/auto-thickbox.js
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3281159%40nextgen-gallery&old=3276142%40nextgen-gallery&sfp_email=&sfph_mail=
More wpdevart vulnerabilities
- TI-2022-03651 Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2021-06732 Poll, Survey, Questionnaire and Voting system < 1.5.3 - Unauthenticated Blind SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2023-00852 AP Pricing Tables Lite <= 1.1.6 - Admin+ SQLi CVSS 3.1HIGH 7.2
- TI-2023-00171 Social Like Box and Page by WpDevArt < 0.8.41 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2022-26411 WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php CVSS 4.0MEDIUM 5.1
- TI-2022-23505 WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-2537 · CVE Program
- CVE-2025-2537 · NVD
- FIRST EPSS
- GHSA-m5fw-x833-hv4q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences