CVE-2026-96895
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
Risk Assessment
XSS attacks can lead to admin session hijacking, data theft, or content modification.
Recommendation
It is recommended to update the WP YouTube Lyte plugin to version 1.7.31 or later and restrict contributor role permissions.
Other vulnerabilities in WP YouTube Lyte
Original NVD description (English source)
The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS