CVE-2025-47553
Published: 06 January 2026
Description
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery dzs-videogallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through <= 12.39.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the deserialization of untrusted data flaw by requiring timely patching or upgrading of the vulnerable DZS Video Gallery plugin beyond version 12.39.
Prevents object injection by validating and sanitizing untrusted input data before deserialization processing in the plugin.
Detects the presence of the deserialization vulnerability through regular scanning, enabling proactive remediation.
Security SummaryAI
CVE-2025-47553, published on 2026-01-06, is a Deserialization of Untrusted Data vulnerability (CWE-502) in the DZS Video Gallery WordPress plugin from Digital Zoom Studio (dzs-videogallery). The flaw allows Object Injection and affects all versions from n/a through <=12.39.
With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited over the network by low-privileged authenticated users with low attack complexity and no user interaction required. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/dzs-videogallery/vulnerability/wordpress-dzs-video-gallery-plugin-12-25-php-object-injection-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unsafe deserialization (object injection) in a publicly accessible WordPress plugin directly enables remote exploitation of a server-side application over the network (T1190).