What is the CVSS score of EUVD-2026-59894?

EUVD-2026-59894 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

YouTube Showcase EUVD-2026-59894

| CVE-2026-15790 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-16 Wordfence

GHSA-mwqg-cv4p-5r7g

WordPress XSS Wordpress Plugin Video Gallery Youtube Gallery Playlist Video Grid Emarket Design

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L confirmed by Author-level requirement; UI:R applied because victim page-load is necessary for payload execution, contra Wordfence's UI:N assignment for stored XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 06:16 vuln.today

CVE Published

Aug 16, 2026 - 05:27 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field: EMD_MB_Helper::image_info() returns the attachment's raw post_title, and EMD_MB_Helper::shortcode() interpolates it into title="%s" HTML attributes via sprintf() without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above (upload_files capability required to create the attachment, edit_posts/publish_posts to embed the shortcode), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the YouTube Showcase WordPress plugin (versions up to and including 4.0.4) allows authenticated attackers with Author-level access to inject persistent malicious scripts via the emd_mb_meta shortcode. The flaw originates in two helper methods: EMD_MB_Helper::image_info() at helpers.php:L72 returns a raw, unsanitized attachment post_title, which EMD_MB_Helper::shortcode() at helpers.php:L274 then interpolates directly into an HTML title attribute using sprintf() without calling WordPress's standard esc_attr() function. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changed CVSS vector and the relatively low Author-level access bar make this an actionable patch priority for multi-author WordPress deployments.

Technical ContextAI

The affected product is the WordPress plugin 'Video Gallery - YouTube Gallery, Playlist & Video Grid' (also marketed as Youtube Showcase), identified by CPE cpe:2.3:a:emarket-design:video_gallery_-_youtube_gallery,_playlist_&_video_grid:*:*:*:*:*:*:*:*. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), specifically an output-escaping omission in PHP. The WordPress attachment post_title field is user-controllable by any account with upload_files capability (Author and above). Because EMD_MB_Helper::image_info() retrieves this value raw from the database and passes it to EMD_MB_Helper::shortcode(), which inserts it into an HTML attribute context via an unescaped sprintf() call (title="%s"), an attacker can craft an attachment title containing HTML attribute-breaking payloads such as " onmouseover="malicious_js(). The injected payload is then stored in the WordPress database and rendered into every page that embeds the emd_mb_meta shortcode referencing that attachment.

RemediationAI

Update the 'Video Gallery - YouTube Gallery, Playlist & Video Grid' plugin to a version beyond 4.0.4 as soon as the vendor releases a patched build; monitor the WordPress plugin repository and the Wordfence vulnerability advisory at wordfence.com/threat-intel/vulnerabilities/id/3be5e544-1ea5-46f6-a15b-99b0e3718c91 for a confirmed fix version, as no specific patched release number is available in the current intelligence data. As an immediate compensating control, restrict the upload_files and publish_posts capabilities to fully trusted accounts only - effectively removing the Author role from any semi-trusted or public contributor accounts - which eliminates the attacker's ability to create the malicious attachment and embed the shortcode; the trade-off is reduced contributor autonomy and potentially increased admin workload for media management. Alternatively, temporarily deactivate the plugin if video gallery functionality is non-essential, removing the attack surface entirely without data loss. Site administrators should also audit existing media library attachment titles for suspicious HTML characters or JavaScript event-handler patterns as a precautionary sweep.