Lazy load videos and sticky control
Lazy load videos and sticky control has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Lazy load videos and sticky control has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2024.
All of these findings were reported by zakaria. Lazy load videos and sticky control is installed on roughly 70 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2024-11428Lazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Lazy load videos and sticky control
Author
Aishan
This plugin improves page load times by lazy loading videos and displaying only the video preview image until playback begins. It now supports YouTube, Vimeo, Wistia, Dailymotion, JW Player, and self-hosted HTML5 videos, with built-in sticky video functionality that keeps videos visible at the top or bottom of the screen when users scroll away from the video viewport. Features Lazy Load Videos: Reduce initial page load by showing only video thumbnail preview image first. Multiple Video Support: Add more than one video to a page. Only one video plays at a time, and the other video pauses automatically. Sticky Video: Keep videos visible as you scroll by pinning them to the top or bottom of the screen. Multi-Platform Support: Use YouTube, Vimeo, Wistia, Dailymotion, JW Player, or self-hosted HTML5 videos. Custom Styling: Adapt the video presentation with your own CSS. Usage Method 1: Using the Classic Editor (WP Editor) Generate Shortcode in WP Editor: Open the post/page where you want to add your video. In the WordPress editor, click on the LLVASC icon. This will open a popup window. In the popup, add your video ID. For YouTube, Vimeo, Wistia, Dailymotion, and JW Player, use only the video ID, not the full URL. After entering the video ID, click “Ok”. This generates and inserts a shortcode into your content. Shortcode Format: The shortcode added to your content will look like this: [lazy-load-videos-and-sticky-control type=”youtube” id=”iXGoAj7IEys”] Example shortcodes: [lazy-load-videos-and-sticky-control type=”vimeo” id=”76979871″] [lazy-load-videos-and-sticky-control type=”wistia” id=”26sk4lmiix”] [lazy-load-videos-and-sticky-control type=”dailymotion” id=”x75iqs7″] [lazy-load-videos-and-sticky-control type=”jwplayer” id=”hWF9vG66″] [lazy-load-videos-and-sticky-control type=”html5″ url=”YOUR_VIDEO_URL”] Save/Update: Save or update your post/page to apply the changes. Preview and Customize: Preview your page to see the embedded video. If you need to adjust the styling, you can add custom CSS in the General tab of the plugin settings. Method 2: Using Gutenberg Block Add a Block: Open the post/page where you want to add your video using the Gutenberg editor. Click on the “+” icon to add a new block. Select the LLVASC Block: Search for the “LLVASC” block in the block library. Add this block to your content. Enter YouTube Video ID: In the LLVASC block settings, select your video platform and enter the matching video ID. For HTML5, use the media picker to choose the video file. Save/Update: Save or update your post/page to apply the changes. Preview and Customize: Preview your page to see the embedded video. Customize the block settings as needed to adjust the appearance and functionality. Demo Preview Demo
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C