CVE-2025-66062

LowCVSS 3.4

Published: 21/11/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The WP YouTube Lyte plugin by Frank Goossens up to version 1.7.28 contains an Open Redirect vulnerability that enables phishing attacks. The flaw exists in the URL redirection mechanism.

Risk Assessment

An attacker can exploit this vulnerability to redirect users to malicious sites, increasing the risk of phishing and data theft.

Recommendation

It is recommended to update the WP YouTube Lyte plugin to a version newer than 1.7.28 that includes a fix, and to validate all URL redirects.

Other vulnerabilities in WP YouTube Lyte

CVE-2026-96895Medium
The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.

Original NVD description (English source)

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Frank Goossens WP YouTube Lyte wp-youtube-lyte allows Phishing.This issue affects WP YouTube Lyte: from n/a through <= 1.7.28.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS