Video Gallery Youtube Gallery Playlist Video Grid
Monthly
Arbitrary zero-argument PHP function invocation in the Youtube Showcase (Video Gallery - YouTube Gallery, Playlist & Video Grid) plugin for WordPress affects all versions up to and including 4.0.3, letting authenticated Subscriber-level users abuse the emd_delete_file() AJAX handler to call any callable PHP function name with no arguments. Because the handler validates only a nonce and omits a current_user_can() capability check, low-privileged accounts can trigger functions such as phpinfo(), get_defined_vars(), or error_get_last() to disclose sensitive server and application data. No public exploit identified at time of analysis and the issue is not in CISA KEV, so risk is currently theoretical but credible given the low privilege bar.
Stored Cross-Site Scripting in the YouTube Showcase WordPress plugin (versions up to and including 4.0.4) allows authenticated attackers with Author-level access to inject persistent malicious scripts via the `emd_mb_meta` shortcode. The flaw originates in two helper methods: `EMD_MB_Helper::image_info()` at helpers.php:L72 returns a raw, unsanitized attachment `post_title`, which `EMD_MB_Helper::shortcode()` at helpers.php:L274 then interpolates directly into an HTML `title` attribute using `sprintf()` without calling WordPress's standard `esc_attr()` function. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changed CVSS vector and the relatively low Author-level access bar make this an actionable patch priority for multi-author WordPress deployments.
Arbitrary zero-argument PHP function invocation in the Youtube Showcase (Video Gallery - YouTube Gallery, Playlist & Video Grid) plugin for WordPress affects all versions up to and including 4.0.3, letting authenticated Subscriber-level users abuse the emd_delete_file() AJAX handler to call any callable PHP function name with no arguments. Because the handler validates only a nonce and omits a current_user_can() capability check, low-privileged accounts can trigger functions such as phpinfo(), get_defined_vars(), or error_get_last() to disclose sensitive server and application data. No public exploit identified at time of analysis and the issue is not in CISA KEV, so risk is currently theoretical but credible given the low privilege bar.
Stored Cross-Site Scripting in the YouTube Showcase WordPress plugin (versions up to and including 4.0.4) allows authenticated attackers with Author-level access to inject persistent malicious scripts via the `emd_mb_meta` shortcode. The flaw originates in two helper methods: `EMD_MB_Helper::image_info()` at helpers.php:L72 returns a raw, unsanitized attachment `post_title`, which `EMD_MB_Helper::shortcode()` at helpers.php:L274 then interpolates directly into an HTML `title` attribute using `sprintf()` without calling WordPress's standard `esc_attr()` function. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changed CVSS vector and the relatively low Author-level access bar make this an actionable patch priority for multi-author WordPress deployments.