Description

The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field: EMD_MB_Helper::image_info() returns the attachment's raw post_title, and EMD_MB_Helper::shortcode() interpolates it into title="%s" HTML attributes via sprintf() without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above (upload_files capability required to create the attachment, edit_posts/publish_posts to embed the shortcode), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-16T06:16:50.967Z",
  "pubdate": "2026-08-16T06:16:50.967Z",
  "executiveSummary": "The Youtube Showcase plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability affecting versions up to, and including, 4.0.4. This security defect enables authenticated attackers with author-level privileges to inject arbitrary web scripts into web pages via the 'emd_mb_meta' shortcode. The root cause stems from inadequate input sanitization and a lack of proper output escaping on attachment titles. Consequently, malicious payloads stored within attachment titles execute in the context of a victim's browser whenever an injected page is accessed. Successful exploitation of this vulnerability can lead to session hijacking, defacement, or unauthorized actions performed on behalf of authenticated users visiting the compromised pages. Prerequisites for exploitation include author-level access or above, specifically requiring the 'upload_files' capability to create malicious attachments and 'edit_posts' or 'publish_posts' capabilities to embed the vulnerable shortcode into WordPress posts or pages.",
  "technicalDetails": "The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and the absence of output escaping mechanisms applied to attachment titles referenced by the 'emd_mb_meta' shortcode's image field. Specifically, the vulnerable component involves the EMD_MB_Helper::image_info() function, which retrieves and returns the raw post_title of an attachment without performing adequate sanitization. Furthermore, the EMD_MB_Helper::shortcode() function insecurely interpolates this raw attachment title directly into a title=\"%s\" HTML attribute using the sprintf() function without applying proper context-aware output escaping via esc_attr(). To execute an attack, an authenticated threat actor must possess specific privilege requirements, namely author-level access or higher, which includes the 'upload_files' capability to create a media attachment containing a malicious script payload within its title field. Following the creation of the crafted attachment, the attacker utilizes the 'edit_posts' or 'publish_posts' capabilities to embed the 'emd_mb_meta' shortcode referencing the manipulated image field within a published post or page. When an unsuspecting user accesses the compromised page, the unescaped payload embedded within the HTML attribute is rendered by the browser. The payload behavior results in the execution of arbitrary JavaScript within the security context of the victim's session. Depending on the privileges of the visiting user, post-exploitation impact ranges from stealing session cookies and performing administrative actions to complete compromise of the affected site's integrity."
}