Executive brief
The YouTube Embed WordPress plugin (versions 10.0–10.3) contains a vulnerability that allows attackers to inject malicious scripts into web pages without authentication. When site visitors—including administrators—view affected content, these scripts execute in their browsers, potentially allowing attackers to steal credentials, hijack sessions, or deface content. The plugin has been removed from WordPress.org with no security patch available.
Technical details
The plugin contains an AJAX action that lacks proper authorization checks, relying solely on a nonce value printed on every public-facing page. This nonce is predictable and accessible to unauthenticated attackers. Additionally, the plugin fails to escape user-supplied data before rendering it in the DOM, enabling stored cross-site scripting (XSS). An attacker can craft a request using the publicly available nonce to inject arbitrary JavaScript, which persists in the database and executes whenever any user views the affected content. The plugin was delisted from WordPress.org on July 25, 2025, with no patched version released; affected sites must uninstall it entirely.
Affected products
- YouTube Embed YouTube Embed 10.0 to 10.3
Timeline
- 2026-09-10: disclosed
- 2026-09-13: advisory