Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,805 results · page 16 of 57
Feb 7, 2026Video Onclick: Stored Cross-Site ScriptingCVE-2026-1608 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Video Onclick plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `youtube` shortcode in all versions up to, and including, 0.4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Video Onclick
- Affected
- up to 0.4.7
- What to do
- Affects up to 0.4.7. Update Video Onclick to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 6, 2026Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras.CVE-2026-25643 · Other software · blakeblackshear · reported by GitHubCritical 9.1
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream configuration (config.yaml), allowing direct injection of system commands via the exec: directive. The go2rtc service executes these commands without restrictions. This vulnerability is only exploitable by an administrator or users who have exposed their Frigate install to the open internet with no authentication which allows anyone full administrative control. This vulnerability is fixed in 0.16.4.
- Product
- frigate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Docus – YouTube Video Playlist: Stored Cross-Site ScriptingCVE-2026-1888 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Docus – YouTube Video Playlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'docusplaylist' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Docus – YouTube Video Playlist
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Docus – YouTube Video Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 2, 2026Wildfire IM is an instant messaging and real-time audio/video solution.CVE-2025-66480 · Other software · wildfirechat · reported by GitHubCritical 9.8
Wildfire IM is an instant messaging and real-time audio/video solution. Prior to 1.4.3, a critical vulnerability exists in the im-server component related to the file upload functionality found in com.xiaoleilu.loServer.action.UploadFileAction. The application exposes an endpoint (/fs) that handles multipart file uploads but fails to properly sanitize the filename provided by the user. Specifically, the writeFileUploadData method directly concatenates the configured storage directory with the filename extracted from the upload request without stripping directory traversal sequences (e.g., ../../). This vulnerability allows an attacker to write arbitrary files to any location on the server's filesystem where the application process has write permissions. By uploading malicious files (such as scripts, executables, or overwriting configuration files like authorized_keys or cron jobs), an attacker can achieve Remote Code Execution (RCE) and completely compromise the server. This vulnerability is fixed in 1.4.3.
- Product
- im-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2026Free Photo & Video Vault 0.0.2 contains a directory traversal web vulnerability that allows remote attackers to manipulate application path requests and access CVE-2021-47921 · Other software · Author: Scott Ferreira · reported by VulnCheckHigh 7.1
Free Photo & Video Vault 0.0.2 contains a directory traversal web vulnerability that allows remote attackers to manipulate application path requests and access sensitive system files. Attackers can exploit the vulnerability without privileges to retrieve environment variables and access unauthorized system paths.
- Product
- Free Photo & Video Vault - WiFi Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.apple.comvulncheck.com
Feb 1, 2026PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commanCVE-2021-47915 · Websites & servers · PHPSUGAR · reported by VulnCheckHigh 8.6
PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially compromise the web application and database management system.
- Product
- PHP Melody
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpsugar.comphpsugar.com
Feb 1, 2026PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to injectCVE-2021-47914 · Websites & servers · PHPSUGAR · reported by VulnCheckMedium 5.1
PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code. Attackers can exploit this vulnerability to execute arbitrary JavaScript, potentially leading to session hijacking, persistent phishing, and manipulation of application modules.
- Product
- PHP Melody
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpsugar.comphpsugar.com
Feb 1, 2026PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts.CVE-2021-47913 · Websites & servers · PHPSUGAR · reported by VulnCheckMedium 5.1
PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application manipulation.
- Product
- PHP Melody
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpsugar.comphpsugar.com
Jan 30, 2026Socusoft Photo to Video Converter Professional 8.07 contains a local buffer overflow vulnerability in the 'Output Folder' input field that allows attackers to eCVE-2020-37028 · Other software · SOCUSOFT · reported by VulnCheckHigh 8.4
Socusoft Photo to Video Converter Professional 8.07 contains a local buffer overflow vulnerability in the 'Output Folder' input field that allows attackers to execute arbitrary code. Attackers can craft a malicious payload and paste it into the output folder field to trigger a stack-based buffer overflow and potentially execute shellcode.
- Product
- Photo to Video Converter Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Jan 29, 2026immich is a high performance self-hosted photo and video management solution.CVE-2026-23896 · Other software · immich-app · reported by GitHubHigh 7.2
immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the system. Version 2.5.0 fixes the issue.
- Product
- immich
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Nidesoft 3GP Video Converter 2.6.18 contains a local stack buffer overflow vulnerability in the license registration parameter.CVE-2020-36971 · Other software · Nidesoft · reported by VulnCheckHigh 8.4
Nidesoft 3GP Video Converter 2.6.18 contains a local stack buffer overflow vulnerability in the license registration parameter. Attackers can craft a malicious payload and paste it into the 'License Code' field to execute arbitrary code on the system.
- Product
- Nidesoft 3GP Video Converter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnidesoft-3gp-video-converter.software.informer.comexploit-db.com
Jan 28, 2026VidShop – Shoppable Videos for WooCommerce: Time-based SQL InjectionCVE-2026-0702 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- VidShop – Shoppable Videos for WooCommerce
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update VidShop – Shoppable Videos for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 28, 2026Target Video Easy Publish: Stored Cross-Site ScriptingCVE-2025-8072 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder_img’ parameter in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Target Video Easy Publish
- Affected
- up to 3.8.8
- What to do
- Affects up to 3.8.8. Update Target Video Easy Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 24, 2026All-in-One Video Gallery: Unauthorized modification of dataCVE-2025-15516 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_callback_store_user_meta() function in versions 4.1.0 to 4.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary string-based user meta keys for their own account.
- Product
- All-in-One Video Gallery
- Affected
- 4.1.0 to 4.6.4
- What to do
- Affects 4.1.0 to 4.6.4. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 24, 2026WP Youtube Video Gallery: Cross-Site Request ForgeryCVE-2025-14906 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Youtube Video Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce verification on the wpYTVideoGallerySettingSave() function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Youtube Video Gallery
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Youtube Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 23, 2026MyTube is a self-hosted downloader and player for several video websites.CVE-2026-24140 · Other software · franklioxygen · reported by GitHubLow 2.7
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78.
- Product
- MyTube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026MyTube is a self-hosted downloader and player for several video websites.CVE-2026-24139 · Other software · franklioxygen · reported by GitHubHigh 8.7
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing guest users to download the complete application database. The application fails to properly validate user permissions on the database export endpoint, enabling low-privileged users to access sensitive data they should not have permission to view.
- Product
- MyTube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026All-in-One Video Gallery: Unauthorized modification of dataCVE-2025-14947 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_create_bunny_stream_video`, `ajax_callback_get_bunny_stream_video`, and `ajax_callback_delete_bunny_stream_video` functions in all versions up to, and including, 4.6.4. This makes it possible for unauthenticated attackers to create and delete videos on the Bunny Stream CDN associated with the victim's account, provided they can obtain a valid nonce which is exposed in public player templates.
- Product
- All-in-One Video Gallery
- Affected
- up to 4.6.4
- What to do
- Affects up to 4.6.4. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026Automatic Featured Images from Videos: Missing AuthorizationCVE-2026-24535 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.7.
- Product
- Automatic Featured Images from Videos
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Automatic Featured Images from Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Universal Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69053 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal-video-player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 3.8.4.
- Product
- Universal Video Player
- Affected
- up to 3.8.4
- What to do
- Affects up to 3.8.4. Update Universal Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Universal Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69048 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal-video-player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 3.8.4.
- Product
- Universal Video Player
- Affected
- up to 3.8.4
- What to do
- Affects up to 3.8.4. Update Universal Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026JNews - Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68906 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews - Video jnews-video allows Reflected XSS.This issue affects JNews - Video: from n/a through <= 11.0.2.
- Product
- JNews - Video
- Affected
- up to 11.0.2
- What to do
- Affects up to 11.0.2. Update JNews - Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026DZS Video Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49049 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affects DZS Video Gallery: from n/a through <= 12.39.
- Product
- DZS Video Gallery
- Affected
- up to 12.39
- What to do
- Affects up to 12.39. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Image&Video FullScreen Background: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47666 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Image&Video FullScreen Background lbg_fullscreen_fullwidth_slider allows Reflected XSS.This issue affects Image&Video FullScreen Background: from n/a through <= 1.6.7.
- Product
- Image&Video FullScreen Background
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Image&Video FullScreen Background to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026HTML5 Video Player with Playlist & Multiple Skins: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32123 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Video Player with Playlist & Multiple Skins lbg-vp2-html5-rightside allows Reflected XSS.This issue affects HTML5 Video Player with Playlist & Multiple Skins: from n/a through <= 5.3.5.
- Product
- HTML5 Video Player with Playlist & Multiple Skins
- Affected
- up to 5.3.5
- What to do
- Affects up to 5.3.5. Update HTML5 Video Player with Playlist & Multiple Skins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026HTML5 Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27005 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Video Player lbg-vp2-html5-bottom allows Reflected XSS.This issue affects HTML5 Video Player: from n/a through <= 5.3.5.
- Product
- HTML5 Video Player
- Affected
- up to 5.3.5
- What to do
- Affects up to 5.3.5. Update HTML5 Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-23526 · Other software · cvat-ai · reported by GitHubHigh 8.5
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to the data in the CVAT instance. Version 2.55.0 fixes the issue. As a workaround, review the list of users with staff status and revoke it from any users that are not expected to have superuser privileges.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-23516 · Other software · cvat-ai · reported by GitHubHigh 8.6
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or project, then get the victim user to either edit that label, or view a shape that refers to that label; and/or get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. This gives the attacker temporary access to all CVAT resources that the victim user can access. Version 2.55.0 fixes the issue.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026MyTube is a self-hosted downloader and player for several video websites.CVE-2026-23848 · Other software · franklioxygen · reported by GitHubMedium 6.5
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypass via `X-Forwarded-For` header spoofing allows unauthenticated attackers to bypass IP-based rate limiting on general API endpoints. Attackers can spoof client IPs by manipulating the `X-Forwarded-For` header, enabling unlimited requests to protected endpoints, including general API endpoints (enabling DoS) and other rate-limited functionality. Version 1.7.71 contains a patch for the issue.
- Product
- MyTube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026MyTube is a self-hosted downloader and player for several video websites.CVE-2026-23837 · Other software · franklioxygen · reported by GitHubCritical 9.8
MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By simply not providing an authentication cookie (making req.user undefined), a request is incorrectly passed through to downstream handlers. All users running MyTube with loginEnabled: true are impacted. This flaw allows an attacker to access and modify application settings via /api/settings, change administrative and visitor passwords, and access other protected routes that rely on this specific middleware. The problem is patched in v1.7.66. MyTube maintainers recommend all users upgrade to at least version v1.7.64 immediately to secure their instances. The fix ensures that the middleware explicitly blocks requests if a user is not authenticated, rather than defaulting to next(). Those who cannot upgrade immediately can mitigate risk by restricting network access by usi a firewall or reverse proxy (like Nginx) to restrict access to the /api/ endpoints to trusted IP addresses only or, if they are comfortable editing the source cod
- Product
- MyTube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.CVE-2025-51602 · Other software · VideoLAN · reported by MITREMedium 4.8
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.
- Product
- VLC media player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.videolan.orgvideolan.org
Jan 16, 2026All-in-One Video Gallery: Arbitrary file uploadCVE-2025-12957 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.5.7. This is due to insufficient file type validation detecting VTT files, allowing double extension files to bypass sanitization while being accepted as a valid VTT file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- All-in-One Video Gallery
- Affected
- up to 4.5.7
- What to do
- Affects up to 4.5.7. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 15, 2026YouTube Video Grabber, now referred to as YouTube Downloader, 1.9.9.1 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code bCVE-2021-47775 · Other software · Litexmedia · reported by VulnCheckHigh 8.4
YouTube Video Grabber, now referred to as YouTube Downloader, 1.9.9.1 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the Structured Exception Handler. Attackers can craft a malicious payload of 712 bytes with SEH manipulation to trigger a bind shell connection on a specified local port.
- Product
- YouTube Video Grabber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comlitexmedia.com
Jan 13, 2026Multi-thread race condition vulnerability in the video framework module.CVE-2025-68960 · Other software · Huawei · reported by psirt@huawei.comHigh 8.4
Multi-thread race condition vulnerability in the video framework module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jan 13, 2026AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its registration form that causes application crashes.CVE-2023-54328 · Other software · Aimone-Video-Converter · reported by VulnCheckMedium 5.1
AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its registration form that causes application crashes. Attackers can generate a 7000-byte payload to trigger the denial of service and potentially exploit the software's registration mechanism.
- Product
- AimOne Video Converter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaimone-video-converter.software.informer.comgithub.com
Jan 12, 2026Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras.CVE-2025-68622 · Other software · espressif · reported by GitHubMedium 6.8
Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0.
- Product
- esp-usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcomponents.espressif.comgithub.com
Jan 11, 2026Certain NVR models developed by A-Plus Video Technologies has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access the dCVE-2026-0853 · Other software · A-Plus Video Technologies · reported by twcert@cert.org.twMedium 6.9
Certain NVR models developed by A-Plus Video Technologies has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access the debug page and obtain device status information.
- Product
- AP-RM864P
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 8, 2026Famous - Responsive Image And Video Grid Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27004 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Famous - Responsive Image And Video Grid Gallery WordPress Plugin famous_grid_image_and_video_gallery allows Reflected XSS.This issue affects Famous - Responsive Image And Video Grid Gallery WordPress Plugin: from n/a through <= 1.4.
- Product
- Famous - Responsive Image And Video Grid Gallery
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Famous - Responsive Image And Video Grid Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026CountDown With Image or Video Background: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27002 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup CountDown With Image or Video Background countdown-with-background allows Reflected XSS.This issue affects CountDown With Image or Video Background: from n/a through <= 1.5.
- Product
- CountDown With Image or Video Background
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update CountDown With Image or Video Background to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026ClipBucket v5 is an open source video sharing platform.CVE-2026-21875 · Other software · MacWarrior · reported by GitHubCritical 9.8
ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment section within a channel. When adding a comment within a channel, there is a POST request to the /actions/ajax.php endpoint. The obj_id parameter within the POST request to /actions/ajax.php is then used within the user_exists function of the upload/includes/classes/user.class. php file as the $id parameter. It is then used within the count function of the upload/includes/classes/db.class. php file. The $id parameter is concatenated into the query without validation or sanitization, and a user-supplied input like 1' or 1=1-- - can be used to trigger the injection. This issue does not have a fix at the time of publication.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026DZS Video Gallery: Deserialization of Untrusted DataCVE-2025-47552 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.37.
- Product
- DZS Video Gallery
- Affected
- up to 12.37
- What to do
- Affects up to 12.37. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026Memory corruption while processing a video session to set video parameters.CVE-2025-47343 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing a video session to set video parameters.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Transient DOS while parsing video packets received from the video firmware.CVE-2025-47330 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 5.5
Transient DOS while parsing video packets received from the video firmware.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026DZS Video Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32300 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XSS.This issue affects DZS Video Gallery: from n/a through 12.25.
- Product
- DZS Video Gallery
- Affected
- up to 12.25
- What to do
- Affects up to 12.25. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2026DZS Video Gallery: Deserialization of Untrusted DataCVE-2025-47553 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.25.
- Product
- DZS Video Gallery
- Affected
- up to 12.25
- What to do
- Affects up to 12.25. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Post Video Players: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62143 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allows Retrieve Embedded Sensitive Data.This issue affects Post Video Players: from n/a through <= 1.163.
- Product
- Post Video Players
- Affected
- up to 1.163
- What to do
- Affects up to 1.163. Update Post Video Players to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Live Shopping & Shoppable Videos For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-62080 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Cross Site Request Forgery.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through <= 2.2.0.
- Product
- Live Shopping & Shoppable Videos For WooCommerce
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Live Shopping & Shoppable Videos For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Live Shopping & Shoppable Videos For WooCommerce: Missing AuthorizationCVE-2025-62081 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through <= 2.2.0.
- Product
- Live Shopping & Shoppable Videos For WooCommerce
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Live Shopping & Shoppable Videos For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Post Video Players: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62142 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allows Stored XSS.This issue affects Post Video Players: from n/a through <= 1.163.
- Product
- Post Video Players
- Affected
- up to 1.163
- What to do
- Affects up to 1.163. Update Post Video Players to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025MAS Videos: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62753 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MadrasThemes MAS Videos masvideos allows PHP Local File Inclusion.This issue affects MAS Videos: from n/a through <= 1.3.4.
- Product
- MAS Videos
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update MAS Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.