CVE-2026-61995
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.
Risk Assessment
An unauthenticated attacker may inject script, potentially leading to session theft or actions on behalf of the user.
Recommendation
Update the YouTube Showcase plugin to a version newer than 4.1.0 and deploy security headers (CSP).
Other vulnerabilities in YouTube Showcase
See all- CVE-2026-15790Medium
The Youtube Showcase plugin for WordPress up to version 4.0.4 is vulnerable to Stored Cross-Site Scripting via the 'emd_mb_meta' shortcode. Attachment titles are interpolated into HTML attributes without proper escaping, allowing authenticated attackers with author-level access and above to inject arbitrary scripts.
- CVE-2026-12923High
The Youtube Showcase plugin for WordPress up to version 4.0.3 is vulnerable to arbitrary PHP function call due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler. Authenticated attackers with Subscriber-level access or higher can invoke zero-argument functions like phpinfo or phpversion, leading to information disclosure.
- CVE-2025-15636Medium
The YouTube Showcase plugin for WordPress is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 3.5.1.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS