Lazy Load for Videos
Lazy Load for Videos has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.
Every one of the 2 issues recorded for Lazy Load for Videos has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Lazy Load for Videos is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-7732Lazy Load for Videos <= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes
Read the full analysisVulnerability Records

Lazy Load for Videos
Author
kevinweber
This plugin improves page load time and increases your Google PageSpeed Score. It works with oEmbed and replaces embedded Youtube and Vimeo videos with a clickable preview image. By loading videos only when the user clicks on the preview image, no unnecessary JavaScript is loaded. Especially on sites with many embedded videos this will make your visitors happy. Additionally, all Youtube videos are loaded in a privacy-enhanced mode using the “https://www.youtube-nocookie.com” embed URL. This plugin works for your existing YouTube and Vimeo blocks. No vendor lock-in and no custom shortcodes: Easily turn the plugin on and off anytime. Plugin review with speed test results on WP Tavern. Developers can contribute on Github. More about the author on kweber.com. Some additional features: Display video titles on preview images Display privacy disclaimer on top of preview images (e.g. for GDPR compliance) Pre-roll and post-roll advertisements: Convert all videos into a playlist and automatically add your corporate video, product teaser or another video advertisement to every video. (Great for branding and video ads!) Hide annotations such as “subscribe to channel” to avoid distractions Add custom CSS via the plugin’s admin panel Choose custom colour for your Vimeo player Hide controls from Youtube player Hide information like the video title and uploader when the video starts playing Even lazy load videos in text widgets (Youtube only) Choose between thumbnail sizes (standard or cover) Choose from several play button styles Choose the traditional red or the alternative white progress bar for the Youtube video player Don’t show related videos at the end of your videos Works with WordPress Multisite and many plugins such as TablePress Future features: Set a custom preview image per video Track how often the videos have been loaded with Google Analytics … YOU want a new feature RIGHT NOW? Please implement it yourself and contribute on Github, and I’ll publish your enhancements to the official WordPress directory. Translators Serbian (sr_RS) – Ogi Djuraskovic Spanish (es_ES) – Carlos Villavicencio If you have created your own language pack, or have an update of an existing one, you can send me your gettext PO and MO so that I can bundle it into my plugin. You can download the latest POT file from here.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C