ZoomIt vulnerabilities
We track 7 vulnerabilities in ZoomIt products across 5 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on January 22, 2026.
Latest ZoomIt vulnerabilities
- 8.5 High severity
DZS Video Gallery: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affects DZS Video Gallery: from n/a through <= 12.39.
- 7.1 High severity
FoodMenu: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomIt FoodMenu allows Reflected XSS. This issue affects FoodMenu: from n/a through 1.20.
- 7.1 High severity
WooCommerce Shop Page Builder: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomIt WooCommerce Shop Page Builder allows Reflected XSS. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7.
- 9.8 Critical severity
ZoomSounds: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through <= 6.91.
- 7.5 High severity
ZoomSounds - WordPress Wave Audio Player with…: External Control of File Name or Path
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the co
- 8.1 High severity
ZoomSounds - WordPress Wave Audio Player with…: Missing Authorization
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions u
- 9.8 Critical severity
ZoomSounds - WordPress Wave Audio Player with…: Deserialization of Untrusted Data
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unaut