CVE-2026-88793

Received Received - Intake

YouTube Embed Plugin Authenticated Stored Cross-Site Scripting

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: WPScan

Description

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-88793

Affected Vendors & Products

Vendor	Product	Version / Range
youtube_embed	wordpress_plugin	From 10.0 (inc) to 10.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the YouTube Embed WordPress plugin versions 10.0 to 10.3. It lacks proper authorization checks on an AJAX action, relying only on a nonce for security. The plugin also fails to escape stored data before rendering, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute when any user, including administrators, views the affected content.

Impact Analysis

Unauthenticated attackers can exploit this to store malicious scripts on your WordPress site. When users or administrators view the affected pages, the scripts run in their sessions, potentially stealing sensitive data, taking control of accounts, or spreading malware. This compromises site integrity and user trust.

Compliance Impact

This vulnerability can lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. If attackers access personal or health information, organizations may face legal penalties, fines, and reputational damage due to non-compliance with these regulations.

Mitigation Strategies

Update the YouTube Embed WordPress plugin to the latest version beyond 10.3 to ensure the vulnerability is patched. If an update is not available, consider disabling or removing the plugin immediately to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-88793. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70