External risk intelligence

DZS Video Gallery Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-47552

The vulnerability affects a WordPress plugin, which is a type of web application component. WordPress plugins are commonly deployed as part of public-facing web services, making them reachable via the internet in standard configurations.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the DZS Video Gallery component, specifically related to the deserialization of untrusted data. This flaw could allow attackers to inject malicious objects, potentially leading to significant compromise of systems where this component is utilized. The main concern at this stage is to confirm if and where this component is deployed within our environment to assess any potential exposure.

Flaw allows untrusted data to inject malicious code.
Affects DZS Video Gallery software, potentially externally.
Confirm relevance and any exposure to our environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data over the network to the DZS Video Gallery. This data would trigger a deserialization flaw, allowing the attacker to inject malicious objects into the application. If successful, this could lead to a compromise of the application's integrity and availability.

Accessible via the network.
Triggered by unsanitized deserialization.
Allows object injection and data manipulation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject malicious objects into the DZS Video Gallery when supported by the advisory. This could lead to unauthorized code execution or manipulation of the gallery's functionality.

Affected: DZS Video Gallery data.
Exposure: Untrusted data deserialization.
Consequence: Potential unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The DZS Video Gallery plugin, a component of web applications, requires coordinated action between application owners and security teams. The first step is to identify all DZS Video Gallery instances, assess their business criticality and network exposure, and then assign ownership for remediation planning.

Application owners should manage the remediation.
Verify DZS Video Gallery installations.
Plan updates during scheduled maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DZS Video Gallery plugin used for?

DZS Video Gallery is a WordPress plugin designed to manage and display multimedia content on websites. It functions as a component within the WordPress ecosystem, allowing administrators to embed and organize video assets. Because it integrates directly into web applications, it serves as an extension of a site's public interface, processing incoming requests to render gallery content for end users.

What does CVE-2025-47552 mean by object injection?

This vulnerability involves a weakness called Deserialization of Untrusted Data (CWE-502). It occurs when the plugin takes data from an outside source and rebuilds it into a complex object without checking if that data is safe. If the input is malicious, the application may unintentionally process it as legitimate code, potentially allowing an attacker to manipulate the gallery's functions or execute unauthorized commands on the host server.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specifically crafted, unsanitized data over the network to the affected plugin. The vulnerability relies on the plugin's internal handling of this incoming data during the deserialization process. Importantly, standard web traffic that does not contain these intentionally malicious data structures will not trigger the vulnerability; it requires a targeted, crafted input designed to exploit the plugin's object-rebuilding logic.

Why should I care about this as a Halo Surface Signal user?

Halo Surface Signal identifies this vulnerability as having an external classification because the plugin is typically deployed as part of public-facing web services. If your site is accessible via the internet, the component is reachable by remote actors. This means the plugin does not need to be hidden behind a firewall for an attacker to reach it, making it a priority to locate and secure these instances.

When should I take action to address this issue?

You should begin by confirming where DZS Video Gallery is installed across your environment. Since this is a critical vulnerability, coordinating with application owners to verify deployments and assess the business impact of each instance is the recommended first step. Once you have identified where the software is running, you can effectively plan for updates or necessary maintenance during your next scheduled window.

References

patchstack.com/database/wordpress/plugin/dzs-videogallery/vulnerabil…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.