High severity · published Aug 28, 2025
CVE-2025-7812
Video Share VOD – Turnkey Video Site Builder Script <= 2.7.6 - Cross-Site Request Forgery to Command Injection
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.6. This is due to missing or incorrect nonce validation on the adminExport() function. This makes it possible for unauthenticated attackers to update settings and execute remote code when the Server command execution setting is enabled via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
Video Share VOD – Turnkey Video Site Builder Script · videowhisper
through 2.7.6 · source: vendor
Affected product
VS
Video Share VOD – Turnkey Video Site Builder Script
videowhisper
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7812
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7812
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/video-share-vod/trunk/inc/options.php#L728
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/video-share-vod/trunk/video-share-vod.php#L3360
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3348480/video-share-vod/trunk/video-share-vod.php
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/b9e499c4-e683-4587-b0ab-7f4ecde94e41?source=cve
More from Video Share VOD – Turnkey Video Site Builder Script
6.4
CVE-2024-13393
Video Share VOD – Turnkey Video Site Builder Script <= 2.6.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-12449
Video Share VOD – Turnkey Video Site Builder Script <= 2.6.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
4.4
CVE-2025-13727
Video Share VOD <= 2.7.11 - Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta Values