Dzs Videogallery Vulnerabilities

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affects DZS Video Gallery: from n/a through <= 12.37.

Affected:

up to 12.37

Fix:

No patched version reported

Disclosed:

Jan 22, 2026

CVE-2025-49049 on NVD →

The DZS Video Gallery plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 12.39 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and...

CVSS:

6.5

Affected:

up to 12.39

Fixed in:

12.40

Disclosed:

Jan 12, 2026

CVE-2025-49049 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XSS.This issue affects DZS Video Gallery: from n/a through 12.25.

Affected:

up to 12.25

Fix:

No patched version reported

Disclosed:

Jan 7, 2026

CVE-2025-32300 on NVD →

[en] Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.37.

Affected:

up to 12.25

Fix:

No patched version reported

Disclosed:

Jan 7, 2026

CVE-2025-47552 on NVD →

[en] Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.25.

Affected:

up to 12.25

Fix:

No patched version reported

Disclosed:

Jan 6, 2026

CVE-2025-47553 on NVD →

The DZS Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 12.39 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successful...

CVSS:

6.1

Affected:

up to 12.39

Fixed in:

12.40

Disclosed:

May 22, 2025

CVE-2025-32300 on NVD →

The DZS Video Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 12.39 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vu...

CVSS:

8.8

Affected:

up to 12.39

Fixed in:

12.40

Disclosed:

May 21, 2025

CVE-2025-47553 on NVD →

The DZS Video Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 12.39 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is presen...

CVSS:

9.8

Affected:

up to 12.39

Fixed in:

12.40

Disclosed:

May 20, 2025

CVE-2025-47552 on NVD →

The DZS Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'initer' parameter in versions up to, and including, 8.60 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exec...

CVSS:

7.2

Affected:

up to 8.60

Fix:

No patched version reported

Disclosed:

Mar 11, 2016

DZS Video gallery plugin is prone to unauthenticated CSRF and XSS vulnerabilities. Upgrade the plugin.

Affected:

up to 8.61

Fixed in:

8.61

Disclosed:

Mar 11, 2016

The DZS Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'initer' parameter in versions up to, and including, 8.60 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exec...

Affected:

up to 8.60

Fix:

No patched version reported

Disclosed:

Mar 11, 2016

This plugin is prone to a cross site scripting vulnerability in ajax.php source parameter. Update the plugin.

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

May 15, 2015

[en] Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.

Affected:

up to 7.95

Fixed in:

7.95

Disclosed:

Nov 26, 2014

CVE-2014-9094 on NVD →

Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.

CVSS:

6.1

Affected:

up to 7.95

Fixed in:

7.95

Disclosed:

Sep 27, 2014

CVE-2014-9094 on NVD →

The DZS Video Gallery plugin for WordPress is vulnerable to remote/local file inclusion in versions up to, and excluding, 7.95. This can allow unauthenticated attackers to retrieve local and remote files with a .swf extension.

CVSS:

5.3

Affected:

up to 7.95

Fixed in:

7.95

Disclosed:

Sep 27, 2014

The DZS Video Gallery plugin for WordPress is vulnerable to remote/local file inclusion in versions up to, and including, 3.1.3. This can allow unauthenticated attackers to retrieve local and remote files with a .swf extension.

Affected:

up to 7.95

Fixed in:

7.95

Disclosed:

Sep 27, 2014

The DZS Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ajax.php 'source' parameter in versions up to, and including 9.63 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t...

CVSS:

6.1

Affected:

up to 9.63

Fixed in:

9.64

Disclosed:

Aug 1, 2014

Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the logoLink parameter to (1) preview.swf, (2) preview_skin_rouge.swf, (3) preview_allchars.swf, or (4) preview_skin_overlay.swf in de...

CVSS:

6.1

Affected:

up to 7.95

Fixed in:

7.95

Disclosed:

Aug 1, 2014

CVE-2014-3923 on NVD →

The DZS Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ajax.php 'source' parameter in versions up to, and including 9.63 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t...

Affected:

up to 9.64

Fixed in:

9.64

Disclosed:

Aug 1, 2014

[en] Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the logoLink parameter to (1) preview.swf, (2) preview_skin_rouge.swf, (3) preview_allchars.swf, or (4) preview_skin_overlay.swf...

Affected:

up to 7.95

Fixed in:

7.95

Disclosed:

May 30, 2014

CVE-2014-3923 on NVD →

DZS Video Gallery plugin is prone to remote and local files disclosure vulnerabilities. Upgrade the plugin.

Affected:

up to 3.1.4

Fixed in:

3.1.4

Disclosed:

Dec 6, 2013

WordPress DZS Video Gallery plugin is prone to a remote file upload vulnerability. Upgrade the plugin.

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Nov 26, 2013

The dzs-videogallery WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability.

Affected:

up to 8.61

Fixed in:

8.61

Affected:

up to 9.64

Fixed in:

9.64

Affected:

up to 9.64

Fixed in:

9.64

The dzs-videogallery WordPress plugin was affected by a Remote File Disclosure security vulnerability.

Affected:

up to 7.95

Fixed in:

7.95