CVE-2026-96895

6.8 Moyenne

Publiée le 27/09/2026 à 08:17 · Modifiée le 28/09/2026 à 17:17 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.

Traduire en français

Produits concernés

Unknown WP YouTube Lyte

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.8 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-79

Références

https://wpscan.com/vulnerability/15978f11-a7bd-41f0-94bf-069be4d03987/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories