YouTube Showcase EUVD-2026-112961

Exploitation targets the YouTube Showcase WordPress plugin at versions 4.1.0 and earlier, where attacker-supplied input is reflected without proper sanitization/output encoding. Although unauthenticated (PR:N), the attack is not zero-interaction: per UI:R, a victim must be induced to click a crafted link or load attacker-influenced content for the payload to execute in their browser, which is the primary limiting factor. The specific plugin parameter or endpoint that reflects the payload is not described in the available sources. Realistic impact is highest when the lured victim is a privileged user (e.g., administrator) whose session can then be abused.

This is a moderate-severity reflected/input-based Cross-Site Scripting flaw (CWE-79) in the WordPress plugin YouTube Showcase at versions <= 4.1.0, carrying a CVSS 3.1 base score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The signals are internally consistent but modest: the attack is network-reachable and low-complexity with no privileges required (PR:N), but it explicitly requires user interaction (UI:R), which materially lowers real-world exploitability versus a no-interaction flaw. The scope change (S:C) reflects script executing in the victim's browser context rather than the server, and the Low confidentiality/integrity/availability impacts reflect typical XSS consequences (session/token theft, limited action-on-behalf, UI defacement) rather than direct system compromise. No CISA KEV listing is present and no EPSS score was provided, so there is no evidence of active or widespread exploitation; the only source is a Patchstack advisory reference, not verified working exploit code. The vendor's priority label is 'this_week' - meaning it warrants near-term patching but is not flagged act_now/emergency. Net: a legitimate but not top-tier priority - a widely-applicable bug class in a niche plugin, where the UI:R requirement and absence of exploitation evidence argue for prompt-but-routine remediation rather than crisis response.

An unauthenticated attacker crafts a malicious URL or input that is reflected unsanitized by the YouTube Showcase plugin and sends it to a victim (e.g., a logged-in site administrator or visitor). When the victim opens the link or page, attacker-controlled JavaScript executes in their browser session, enabling session/cookie theft, forced actions, or page manipulation. No public working exploit is identified at time of analysis, and successful exploitation depends on the victim interacting with the crafted content (UI:R).