What is the CVSS score of CVE-2026-3299?

CVE-2026-3299 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3299

EUVD-2026-23139 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-16 Wordfence

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 16, 2026 - 01:49 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 01:45 euvd

EUVD-2026-23139

Analysis Generated

Apr 16, 2026 - 01:45 vuln.today

CVE Published

Apr 16, 2026 - 01:24 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP YouTube Lyte plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lyte' shortcode in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in WP YouTube Lyte plugin for WordPress versions up to 1.7.29 allows authenticated contributors and above to inject arbitrary JavaScript via the 'lyte' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users viewing affected pages. No public exploit code or active exploitation has been confirmed at time of analysis; patch is available in version 1.7.30 and later.

Technical ContextAI

The WP YouTube Lyte plugin (CPE: cpe:2.3:a:futtta:wp_youtube_lyte) is a WordPress extension that embeds YouTube videos using a custom shortcode handler. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), where the plugin's 'lyte' shortcode processor fails to properly sanitize and escape user-supplied attributes before rendering them into page HTML. WordPress shortcode attributes are inherently user-controlled when posts and pages are created or edited by authenticated users. The plugin does not apply adequate input validation (sanitization) when accepting shortcode parameters, nor does it escape output when rendering those parameters into the final HTML sent to browsers, allowing attribute values to be interpreted as executable JavaScript within the page context.

RemediationAI

Upgrade WP YouTube Lyte to version 1.7.30 or later immediately via WordPress admin dashboard (Plugins > Updates) or by downloading the patched version from plugins.wordpress.org. No workarounds are available for existing installations; the vulnerability cannot be mitigated without patching due to the shortcode processing being core to the plugin's functionality. If upgrading is not immediately possible, restrict contributor-level access to users who have been vetted for trustworthiness, and monitor post/page revisions for suspicious shortcode attributes containing script tags or event handlers. However, these compensating controls only reduce risk and do not eliminate it; patching remains mandatory.