MAS Videos

MAS Videos has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 1 is fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Missing Authorization, behind 1 of the records (50%). Other recurring categories include PHP Remote File Inclusion.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, one record each. MAS Videos is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage50%
Open

1

Fixed

1

Get automatic notifications for all MAS Videos vulnerabilities before they are exploited.

Most severe open issueCVSS 7.5CVE-2025-62753

MAS Videos <= 1.3.2 - Authenticated (Contributor+) Local File Inclusion

Read the full analysis

Vulnerability Records

2 records
Plugin Profile
Latestv1.3.5
3.0(7)
60/100
Last Updated
2026-10-22 (6d ago)
Active Installs
1,000+
Downloads
108,373
Requires WP
6.4+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2019-04-11 (8y ago)

MAS Videos is a free plugin that allows you to create and list movies, videos and TV shows. Have you ever wished to build a website similar to YouTube, Netflix or a simple video based website using WordPress ? MAS Videos allows you to do just that. You can create a website similar to YouTube, Netflix or any video based website. MAS Videos’ Features MAS Videos is free and has many advanced features to suit your needs. You can add, edit and manage Movies, TV Shows and Videos just like you manage your posts Create and assign attributes such as Director, Actor, etc to your Movies, TV Shows and Videos Use WordPress’ embed feature to embed Videos, Movies and TV Shows Gutenberg blocks for Movies, TV Shows and Videos Shortcodes and Widgets to display Movies, TV Shows and Videos Manage Playlist using your WP user account. Allows registered users to upload their own videos just like YouTube. Documentation All of our online documentation can be found on our documentation site. External services This plugin can connect to The Movie Database (TMDB) to import movie, TV show and person data. This happens only when a site administrator uses the built-in TMDB importer and has entered a TMDB API key in the plugin settings. The feature is optional and is never used on the site front end. When requests are sent: only during an administrator-initiated action in the WordPress admin — the TMDB importer’s search/fetch step (wp-admin, Tools → Import). No requests are made on the front end or on a schedule by this feature. What is sent: requests go to TMDB’s API over HTTPS and include the site’s configured TMDB API key and the lookup parameters for that action (the search text you enter, or the TMDB id / season / episode numbers being imported, together with a language code and an “include adult” flag). This feature does not send any WordPress user, visitor or site-credential data. What is received: movie, TV show and person metadata (titles, descriptions, dates, credits, genres, etc.) and image URLs, which are stored as the imported posts and their media. TMDB is a third-party service provided by TiVo Platform Technologies LLC, governed by its own terms and privacy policy: Terms of Use: https://www.themoviedb.org/terms-of-use API Terms of Use: https://www.themoviedb.org/api-terms-of-use Privacy Policy: https://www.themoviedb.org/privacy-policy This product uses TMDB and the TMDB APIs but is not endorsed, certified, or otherwise approved by TMDB.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C