CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2025-47552

WordPress DZS Video Gallery plugin <= 12.37 - PHP Object Injection Vulnerability

Status: Published
Published: 2026-01-07
Updated: 2026-04-28
Assigning organization: Patchstack

Description

Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.37.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Digital zoom studio DZS Video Gallery

Default version status: unaffected

n/a to ≤ 12.37affected

References

https://patchstack.com/database/wordpress/plugin/dzs-videogallery/vulnerability/wordpress-dzs-video-gallery-12-25-php-object-injection-vulnerability?_s_id=cve ↗