EUVD-2026-77087
GHSA-mwfg-r67v-rvfv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Stored XSS executes in victim's browser - a different security authority from the WordPress server - warranting S:C; all other metrics align directly with the description.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.
AnalysisAI
Unauthenticated stored XSS in the YouTube Embed WordPress plugin (versions 10.0-10.3) allows any unauthenticated site visitor to inject and persist arbitrary JavaScript in the WordPress database by exploiting an AJAX endpoint that performs no authorization check beyond a nonce embedded in every public-facing page. The stored payload executes in the browser session of any subsequent visitor or administrator who views the affected content, enabling session hijacking, administrative account takeover, or full site compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The plugin must be installed and active on a WordPress site running versions 10.0 through 10.3. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U yields 8.8 (High). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Administrators should update the YouTube Embed WordPress plugin to a version beyond 10.3 immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress instances running YouTube Embed plugin versions 10.0-10.3 and immediately deactivate and remove the plugin; review access logs and database activity for exploitation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Youtube Embed
View allThe YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes,
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for W
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today