All vulnerabilities
CVE-2026-96895

WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes

Unknown WP YouTube Lyte
Open in ThreatlineRecord JSON
CVSS
6.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.7.31Fixed versionCVE List
Published27 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.

Text from CVE List

Affected versions 1

  • WP YouTube Lyteaffected: all versions before 1.7.31CVE List

References 1