CVE-2025-62746
Lifecycle Timeline
2Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeFlavors Featured Video for WordPress – VideographyWP videographywp allows Stored XSS.This issue affects Featured Video for WordPress – VideographyWP: from n/a through <= 1.0.18.
Analysis
Stored cross-site scripting (XSS) in CodeFlavors Featured Video for WordPress (VideographyWP) plugin version 1.0.18 and earlier allows authenticated attackers to inject malicious scripts that execute in the browsers of other site users, potentially compromising administrator accounts and site integrity. The vulnerability stems from improper input sanitization during web page generation, and no public exploit code has been identified at the time of analysis.
Technical Context
The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a foundational cross-site scripting weakness. The VideographyWP plugin, which provides featured video functionality for WordPress sites, fails to properly sanitize or escape user-supplied input before rendering it in the DOM. This allows an attacker to inject arbitrary JavaScript code that persists in the database (stored XSS) and executes whenever the affected page or content is viewed by other users. WordPress plugins that handle media, metadata, or user-generated content are common targets for this class of vulnerability because they often process and display untrusted data without adequate output encoding.
Affected Products
CodeFlavors Featured Video for WordPress (VideographyWP plugin) versions 1.0.18 and all earlier versions are affected. The plugin is available on the WordPress.org plugin repository. Affected administrators should identify installations using this plugin via the WordPress admin dashboard or wp-cli command line tools.
Remediation
Update the VideographyWP plugin to the latest available version released after 1.0.18 via the WordPress admin dashboard (Plugins > Installed Plugins > Featured Video for WordPress - VideographyWP > Update) or directly from the WordPress.org plugin repository. If a patched version is not yet available, temporarily disable the plugin until an update is released. Site administrators should also audit published content created with the plugin for signs of injected scripts and review user account activity logs for unauthorized content modifications. Additional details are available in the Patchstack vulnerability database entry referenced below.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today