Video Expander
Video Expander has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Video Expander has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Chu The Anh. Video Expander is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 0.
CVE-2025-52771Video Expander <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Video Expander
Author
bcupham
Creates shortcode to display video iframes in columns, where each video expands to play on mouse click. Also generates a video thumbnail to use as a placeholder to reduce load time and memory usage. Shortcode format is the following: [video-expander video-url=”THE URL OF YOUR YOUTUBE OR VIMEO VIDEO”]The caption for your video.[/video-expander] Read complete instructions in Installation section Admin can choose how many columns of videos to display. At 800px or less, will automatically display only one column of videos. Accepts Youtube and Vimeo video urls only at this time. Contact me with requests for features
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C