WP YouTube Lyte CVE-2026-96895

Requires an authenticated WordPress account with at least the contributor role on a site running WP YouTube Lyte before 1.7.31, and the attacker must insert a YouTube embed block whose attributes are rendered unescaped. Exploitation is not self-triggering: a higher-privileged user (editor/administrator) must subsequently view or render the malicious block for the stored script to fire (UI:R). This limits realistic impact to sites that grant contributor-or-higher accounts to semi-trusted users and where editorial review of contributor content occurs. Default configurations are affected as long as the plugin is installed and the vulnerable version is in use.

This is a classic high-CVSS-but-modest-real-risk stored XSS. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H = 6.8) is internally inconsistent with the description and inflates severity: the description states the flaw is reachable by a user 'with a role as low as contributor,' which maps to PR:L (not PR:H), and a stored XSS that executes in a victim's browser is a scope-changing (S:C) event with limited, browser-bounded C:L/I:L and A:N - not full C:H/I:H/A:H against the server. Corrected, this is closer to ~5.4. The supporting signals all point to low urgency: EPSS is 0.15% (4th percentile), SSVC records Exploitation=none and Automatable=no (consistent with 'no public exploit identified as actively used' and the requirement for a logged-in contributor plus a victim viewing the block), and there is no CISA KEV listing. A public POC does exist (WPScan), which raises the practical likelihood of opportunistic testing but does not equal active exploitation. Note the SSVC 'Technical Impact: total' conflicts with the realistic bounded impact of a stored XSS - 'total' appears to reflect the inflated C:H/I:H/A:H rather than the actual browser-context effect; treat it with caution.

An attacker who holds (or phishes/registers into) a WordPress contributor account inserts a WP YouTube Lyte embed block with a malicious payload in an unescaped attribute; when an editor or administrator later previews or reviews that draft/post, the script executes in their authenticated session. A public POC is available from WPScan, and the payload could hijack the admin session or perform actions as the higher-privileged viewer. Exploitation requires the low-privilege authenticated foothold plus a victim rendering the content (UI:R), so it is not a drive-by against anonymous visitors.