Youtube Showcase
Monthly
Reflected cross-site scripting in the WordPress plugin YouTube Showcase (versions up to and including 4.1.0) allows remote attackers to inject script that executes in a victim's browser session. The flaw is unauthenticated (PR:N) and low-complexity (AC:L) but requires user interaction (UI:R): a victim must be induced to click a crafted link or load attacker-influenced content, and the resulting scope change (S:C) means the injected code runs with the privileges of the hosting WordPress site. At CVSS 3.1 base 7.1, the realistic worst case is a lured administrator whose session is then abused, which is why it is prioritized for handling this week; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in Emarket-design's YouTube Showcase WordPress plugin up to version 3.5.1 allows authenticated attackers to inject malicious scripts that execute in the context of other users' browsers. No active exploitation or public exploit code has been reported, and EPSS indicates a low 0.03% probability of exploitation over the next 30 days. The vulnerability carries a medium CVSS 6.5 score and requires low-privilege access and user interaction.
Reflected cross-site scripting in the WordPress plugin YouTube Showcase (versions up to and including 4.1.0) allows remote attackers to inject script that executes in a victim's browser session. The flaw is unauthenticated (PR:N) and low-complexity (AC:L) but requires user interaction (UI:R): a victim must be induced to click a crafted link or load attacker-influenced content, and the resulting scope change (S:C) means the injected code runs with the privileges of the hosting WordPress site. At CVSS 3.1 base 7.1, the realistic worst case is a lured administrator whose session is then abused, which is why it is prioritized for handling this week; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in Emarket-design's YouTube Showcase WordPress plugin up to version 3.5.1 allows authenticated attackers to inject malicious scripts that execute in the context of other users' browsers. No active exploitation or public exploit code has been reported, and EPSS indicates a low 0.03% probability of exploitation over the next 30 days. The vulnerability carries a medium CVSS 6.5 score and requires low-privilege access and user interaction.