CVE-2025-2537

🗓️ 03 Jul 2025 12:23:08Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 18 Views

Multiple WordPress plugins vulnerable to Stored Cross-Site Scripting via ThickBox JavaScript library

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2025-2537	29 Jul 202519:31	–	circl
CNNVD	WordPress多款产品跨站脚本漏洞	3 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-2537 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library	3 Jul 202512:23	–	cvelist
EUVD	EUVD-2025-19861	3 Oct 202520:07	–	euvd
NVD	CVE-2025-2537	3 Jul 202513:15	–	nvd
Patchstack	WordPress Auto Thickbox plugin <= 3.5 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library vulnerability	31 Dec 202500:00	–	patchstack
Patchstack	WordPress YouTube Embed, Playlist and Popup by WpDevArt plugin <= 2.6.7 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library vulnerability	31 Dec 202500:00	–	patchstack
Patchstack	WordPress NextGEN Gallery plugin <= 3.59.11 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library vulnerability	31 Dec 202500:00	–	patchstack
Positive Technologies	PT-2025-27796 · WordPress +1 · Wordpress +1	3 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-2537	5 Jul 202513:21	–	redhatcve

Vulners

Node

wpdevart youtube_embed,_playlist_and_popup_by_wpdevartRange≤2.6.7wordpress

denis-de-bernardy auto_thickboxRange≤3.5wordpress

smub photo_gallery,_sliders,_proofing_and_themes_nextgen_galleryRange≤3.59.11wordpress

[
  {
    "vendor": "wpdevart",
    "product": "YouTube Embed, Playlist and Popup by WpDevArt",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.6.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "denis-de-bernardy",
    "product": "Auto Thickbox",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "smub",
    "product": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.59.11",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/youtube-video-player/trunk/front_end/scripts/youtube_embed_front_end.js
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/59ea7390-3587-4fce-b267-bf525dbe3e27
plugins	www.plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/static/Lightbox/thickbox/thickbox.js
plugins	www.plugins.trac.wordpress.org/browser/auto-thickbox/trunk/js/auto-thickbox.js

15 Apr 2026 00:35Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.16.4

EPSS0.00228

SSVC

CWE-79