Youtube Embed
Monthly
Unauthenticated stored XSS in the YouTube Embed WordPress plugin (versions 10.0-10.3) allows any unauthenticated site visitor to inject and persist arbitrary JavaScript in the WordPress database by exploiting an AJAX endpoint that performs no authorization check beyond a nonce embedded in every public-facing page. The stored payload executes in the browser session of any subsequent visitor or administrator who views the affected content, enabling session hijacking, administrative account takeover, or full site compromise. A publicly available exploit exists (reported by WPScan), materially elevating real-world risk for any site running the affected plugin versions.
The YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes, leading to Stored XSS issues by 1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
Unauthenticated stored XSS in the YouTube Embed WordPress plugin (versions 10.0-10.3) allows any unauthenticated site visitor to inject and persist arbitrary JavaScript in the WordPress database by exploiting an AJAX endpoint that performs no authorization check beyond a nonce embedded in every public-facing page. The stored payload executes in the browser session of any subsequent visitor or administrator who views the affected content, enabling session hijacking, administrative account takeover, or full site compromise. A publicly available exploit exists (reported by WPScan), materially elevating real-world risk for any site running the affected plugin versions.
The YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes, leading to Stored XSS issues by 1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.