Description

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-13T21:17:02.197Z",
  "pubdate": "2026-09-13T21:17:02.197Z",
  "executiveSummary": "The YouTube Embed WordPress plugin (versions 10.0 to 10.3) is affected by a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient authorization checks and a lack of input sanitization/output escaping.\nThis flaw allows unauthenticated attackers to inject arbitrary JavaScript payloads into the plugin's data storage via an unprotected AJAX action.\nThe injected scripts are stored within the application database and subsequently rendered in the victim's browser when they access affected content.\nThe vulnerability poses a critical risk to site integrity and administrative security, as the execution of malicious code can occur within the session of an authenticated user, including administrators.\nThe primary requirement for exploitation is the presence of a non-validated, publicly available nonce that is rendered on front-end pages, which facilitates the bypass of intended AJAX access controls.\nThe attack is network-exploitable and does not require prior authentication or elevated privileges, making it highly dangerous for WordPress deployments running the vulnerable plugin versions.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of WordPress AJAX action handlers within the YouTube Embed plugin. The plugin exposes an AJAX action that fails to execute proper authentication or authorization checks, essentially trusting any request that includes a valid nonce. Because the plugin prints the required nonce on every front-end page, it is trivial for an unauthenticated user to retrieve the token and craft a valid, authorized-looking request.\nThe vulnerability is compounded by a secondary failure: the plugin fails to sanitize input or perform context-aware output escaping when processing data sent via this AJAX action. When an attacker sends a malicious payload—specifically crafted JavaScript encapsulated in HTML tags—the plugin accepts the data and stores it directly into the WordPress database.\nThe attack flow follows a structured exploitation path: First, the attacker visits any front-end page of the site to retrieve the public-facing nonce. Second, the attacker utilizes this nonce to perform a POST request to the vulnerable AJAX endpoint. Within this request, the attacker includes the malicious script as part of the data fields that the plugin expects to save. Third, because the server-side code performs no authorization verification, the request is processed, and the XSS payload is committed to the site's database.\nThe impact becomes realized when a user, particularly an administrator, views the compromised content. The WordPress site retrieves the stored, malicious payload from the database and renders it directly into the victim's DOM without prior sanitization. Consequently, the browser interprets the script as legitimate application code and executes it within the context of the user's session.\nThe post-exploitation impact is severe, as the attacker can perform unauthorized actions on behalf of the victim. This includes, but is not limited to, stealing session cookies, performing administrative configuration changes, creating new administrator accounts, or redirecting the user to malicious sites. Because the payload executes with the privileges of the victim, an administrator viewing the content would grant the attacker full control over the WordPress instance."
}