SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-88793

HIGH · CVSS 8.8 EPSS 0.28%

Source: NVD + CISA KEV + EPSS · Published 2026-09-13 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The YouTube Embed WordPress plugin versions 10.0 to 10.3 is vulnerable due to a lack of proper authorization checks on an AJAX action, allowing unauthenticated attackers to store and execute arbitrary web scripts. This vulnerability can lead to cross-site scripting (XSS) attacks, potentially compromising the sessions of any user, including administrators. WordPress site administrators using this plugin should prioritize immediate updates to mitigate the risk of exploitation.

CVE
CVE-2026-88793
Severity
HIGH
CVSS
8.8
EPSS
0.28%
WordPress

Original NVD Description

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.