Zoomify embed for WP
Zoomify embed for WP has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Zoomify embed for WP has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Peter Thaleikis. Zoomify embed for WP is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.2.11.
CVE-2025-58863Zoomify embed for WP <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Zoomify embed for WP
Author
SdeWijs
This Zoomify plugin for WordPress allows you to upload .zif files to your media directory. You can then create the Zoomify imagebox with toolbar by using the shortcode [zoomify file="fileUrl" zskinpath="Default/Dark/Light" zoomlevel=100] (zoomlevel is optional), where “fileUrl” is the url/permalink to the zif-file. The skin parameter has three options: Default, Dark and Light. If the skin parameter is omitted in the shortcode the Default skin will be used. For example, if the permalink to your file is http://example.com/wp-content/uploads/2016/10/myAwesomemap.zif, the shortcode will look like this [zoomify file="http://example.com/wp-content/uploads/2016/10/myAwesomemap.zif" zskinpath="Default"] If copy-pasting this example does not work, please type out the shortcode manually in your WP editor so the double quotes are properly formatted. I am not connected to Zoomify in any way, I coded this plugin for personal use and figured this may come in handy for other Zoomify users. Each Zoomify image had it’s own unique identifier, so you can add muiltiple Zoomify images to a page.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C