Lazy load videos and sticky control

Lazy load videos and sticky control has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Lazy load videos and sticky control has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2024.

All of these findings were reported by zakaria. Lazy load videos and sticky control is installed on roughly 70 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Lazy load videos and sticky control vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2024-11428

Lazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Lazy load videos and sticky control banner
Latestv4.0.3

Lazy load videos and sticky control

Aishan

Author

Aishan

4.2(5)
84/100
Last Updated
2026-08-15 (29d ago)
Active Installs
70+
Downloads
6,231
Requires WP
5.2+
Requires PHP
5.5+
Tested up to
WP 7.0.4
Created
2019-07-06 (7y ago)

This plugin improves page load times by lazy loading videos and displaying only the video preview image until playback begins. It now supports YouTube, Vimeo, Wistia, Dailymotion, JW Player, and self-hosted HTML5 videos, with built-in sticky video functionality that keeps videos visible at the top or bottom of the screen when users scroll away from the video viewport. Features Lazy Load Videos: Reduce initial page load by showing only video thumbnail preview image first. Multiple Video Support: Add more than one video to a page. Only one video plays at a time, and the other video pauses automatically. Sticky Video: Keep videos visible as you scroll by pinning them to the top or bottom of the screen. Multi-Platform Support: Use YouTube, Vimeo, Wistia, Dailymotion, JW Player, or self-hosted HTML5 videos. Custom Styling: Adapt the video presentation with your own CSS. Usage Method 1: Using the Classic Editor (WP Editor) Generate Shortcode in WP Editor: Open the post/page where you want to add your video. In the WordPress editor, click on the LLVASC icon. This will open a popup window. In the popup, add your video ID. For YouTube, Vimeo, Wistia, Dailymotion, and JW Player, use only the video ID, not the full URL. After entering the video ID, click “Ok”. This generates and inserts a shortcode into your content. Shortcode Format: The shortcode added to your content will look like this: [lazy-load-videos-and-sticky-control type=”youtube” id=”iXGoAj7IEys”] Example shortcodes: [lazy-load-videos-and-sticky-control type=”vimeo” id=”76979871&#8243;] [lazy-load-videos-and-sticky-control type=”wistia” id=”26sk4lmiix”] [lazy-load-videos-and-sticky-control type=”dailymotion” id=”x75iqs7&#8243;] [lazy-load-videos-and-sticky-control type=”jwplayer” id=”hWF9vG66&#8243;] [lazy-load-videos-and-sticky-control type=”html5&#8243; url=”YOUR_VIDEO_URL”] Save/Update: Save or update your post/page to apply the changes. Preview and Customize: Preview your page to see the embedded video. If you need to adjust the styling, you can add custom CSS in the General tab of the plugin settings. Method 2: Using Gutenberg Block Add a Block: Open the post/page where you want to add your video using the Gutenberg editor. Click on the “+” icon to add a new block. Select the LLVASC Block: Search for the “LLVASC” block in the block library. Add this block to your content. Enter YouTube Video ID: In the LLVASC block settings, select your video platform and enter the matching video ID. For HTML5, use the media picker to choose the video file. Save/Update: Save or update your post/page to apply the changes. Preview and Customize: Preview your page to see the embedded video. Customize the block settings as needed to adjust the appearance and functionality. Demo Preview Demo

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C