CVE-2026-1825
Stored XSS in Show YouTube Plugin 'syv' Shortcode
Publication date: 2026-03-07
Last updated on: 2026-03-07
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | show_youtube_video | to 1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-1825 is a Stored Cross-Site Scripting (XSS) vulnerability in the Show YouTube video plugin for WordPress, affecting all versions up to and including 1.1. The vulnerability exists because the plugin does not properly sanitize or escape user-supplied attributes in its 'syv' shortcode."}, {'type': 'paragraph', 'content': 'This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute whenever any user accesses the injected page, potentially compromising site security.'}, {'type': 'paragraph', 'content': 'Technically, the plugin fetches YouTube video IDs by scraping YouTube channel pages and embeds videos using iframes. Insufficient validation and sanitization of this data, combined with inadequate filtering of iframe URLs, enable attackers to inject malicious scripts.'}] [1]
How can this vulnerability impact me? :
This vulnerability can lead to the execution of malicious scripts on your WordPress site whenever a user visits a page containing the injected shortcode.
- Attackers with contributor-level access can exploit this to perform actions such as stealing user session cookies, defacing the website, or redirecting users to malicious sites.
- It can compromise the integrity and confidentiality of your website and its users by enabling cross-site scripting attacks.
- Because the attack requires authenticated access, it may be used by insiders or compromised accounts to escalate damage.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'Detection of this vulnerability involves identifying if the Show YouTube video WordPress plugin version 1.1 or earlier is installed and active on your system.'}, {'type': 'paragraph', 'content': "Since the vulnerability is a Stored Cross-Site Scripting (XSS) via the 'syv' shortcode, you can check for usage of this shortcode in WordPress posts or pages."}, {'type': 'paragraph', 'content': 'Commands to detect the plugin version and shortcode usage include:'}, {'type': 'list_item', 'content': 'Use WP-CLI to check installed plugins and their versions: `wp plugin list | grep show-youtube-video`'}, {'type': 'list_item', 'content': "Search for the vulnerable shortcode usage in the WordPress database: `wp search-replace '\\[syv' '' --dry-run` or use SQL queries to find posts containing '[syv' shortcode."}, {'type': 'list_item', 'content': 'Inspect pages or posts for injected scripts by searching for suspicious script tags or iframe elements related to YouTube embedding.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include:'}, {'type': 'list_item', 'content': 'Update the Show YouTube video plugin to a version later than 1.1 if available, where the vulnerability is fixed.'}, {'type': 'list_item', 'content': 'If no update is available, disable or uninstall the plugin to prevent exploitation.'}, {'type': 'list_item', 'content': "Restrict contributor-level and above users from adding or editing content that uses the 'syv' shortcode until the issue is resolved."}, {'type': 'list_item', 'content': "Review and sanitize existing content that uses the 'syv' shortcode to remove any injected malicious scripts."}, {'type': 'list_item', 'content': 'Implement Web Application Firewall (WAF) rules to block malicious payloads attempting to exploit this XSS vulnerability.'}] [1]