CVE-2025-7732 Lazy Load for Videos <= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes

The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lazy‑loading handlers in all versions up to, and including, 2.18.7 due to insufficient input sanitization and output escaping. The plugin’s JavaScript registration handlers read the client‑supplied...

CVE-2025-7732

CVE-2025-7732: The WordPress plugin Lazy Load for Videos (

PT-2025-34821 · WordPress · Lazy Load For Videos

Name of the Vulnerable Software and Affected Versions: Lazy Load for Videos plugin for WordPress versions through 2.18.7 Description: The Lazy Load for Videos plugin for WordPress is susceptible to Stored Cross-Site Scripting through its lazy-loading handlers. Insufficient input sanitization and...

WordPress plugin Lazy Load for Videos 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Linux Distros Unpatched Vulnerability : CVE-2019-16141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the oncecell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy. CVE-2019-16141 Note that Nessus relies on t...

WordPress Lazy Load for Videos plugin <= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via data-video-title and href Attributes vulnerability discovered by Webbernaut in WordPress Plugin Lazy Load for Videos versions = 2.18.7...

Linux Distros Unpatched Vulnerability : CVE-2025-38029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kasan: avoid sleepable page allocation from atomic context applytopterange enters the lazy MMU mode and then invokes kasanpopulatevmallocpte callback on each pa...

Linux Distros Unpatched Vulnerability : CVE-2018-3665

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data...

WordPress Lazy Load Optimizer plugin <= 1.4.7 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Lazy Load Optimizer versions = 1.4.7...

SUSE CVE-2025-38029

In the Linux kernel, the following vulnerability has been resolved: kasan: avoid sleepable page allocation from atomic context applytopterange enters the lazy MMU mode and then invokes kasanpopulatevmallocpte callback on each page table walk iteration. However, the callback can go into sleep when...

DEBIAN-CVE-2025-38029

In the Linux kernel, the following vulnerability has been resolved: kasan: avoid sleepable page allocation from atomic context applytopterange enters the lazy MMU mode and then invokes kasanpopulatevmallocpte callback on each page table walk iteration. However, the callback can go into sleep when...

AZL-70274 CVE-2025-38029 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: kasan: avoid sleepable page allocation from atomic context applytopterange enters the lazy MMU mode and then invokes kasanpopulatevmallocpte callback on each page table walk iteration. However, the callback can go into sleep when...

AZL-64040 CVE-2025-38029 affecting package kernel 6.6.126.1-1

In the Linux kernel, the following vulnerability has been resolved: kasan: avoid sleepable page allocation from atomic context applytopterange enters the lazy MMU mode and then invokes kasanpopulatevmallocpte callback on each page table walk iteration. However, the callback can go into sleep when...

UBUNTU-CVE-2025-38029

In the Linux kernel, the following vulnerability has been resolved: kasan: avoid sleepable page allocation from atomic context applytopterange enters the lazy MMU mode and then invokes kasanpopulatevmallocpte callback on each page table walk iteration. However, the callback can go into sleep when...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fixed the flushtlbrange function when it is used to zap normal PMD entries PMD entries that point to page tables, along with the PTE entries in the pointed-to page table. In the arm64 version of flushtlbrange, there is a...

MAL-2025-4920 Malicious code in lazy-logrocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d35d13ebfd82c66db49337a0483da4a0c5460498a2a1a5941e45f1b44f05a1f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lazy-logrocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d35d13ebfd82c66db49337a0483da4a0c5460498a2a1a5941e45f1b44f05a1f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ASB-A-373467684

In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2023-23733

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Joel James Lazy Social Comments plugin = 2.0.4 versions...

CVE-2022-45481

The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute arbitrary code with no prior authorization or authentication. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...