CVE-2023-0446 in My YouTube Channel Plugin
Summary
by MITRE • 01/23/2023
The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/09/2026
The vulnerability identified as CVE-2023-0446 affects the My YouTube Channel plugin for WordPress, specifically targeting versions up to and including 3.0.12.1. This represents a critical security flaw that exploits the plugin's inadequate input sanitization and output escaping mechanisms within its settings parameters. The vulnerability classification aligns with CWE-79 which defines cross-site scripting as a weakness occurring when an application incorporates untrusted data into web pages without proper validation or escaping, allowing attackers to execute malicious scripts in the context of the victim's browser.
Attackers with administrator-level permissions or higher can leverage this vulnerability to inject arbitrary web scripts into the plugin's settings interface. The stored nature of this XSS vulnerability means that the malicious code is permanently saved within the application's database and will execute whenever any user accesses pages containing the injected content. This creates a persistent threat vector that can affect multiple users without requiring them to click on specific links or perform additional actions beyond accessing the affected pages. The vulnerability demonstrates poor input validation practices that fail to properly sanitize user-supplied data before storing it in the system's database.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with a potential foothold for more sophisticated attacks. Once an attacker successfully injects malicious scripts, they can potentially steal session cookies, redirect users to malicious sites, deface the website, or even escalate privileges further within the WordPress environment. The attack vector requires authentication, which limits the initial threat scope but makes it particularly dangerous when attackers have legitimate administrative access. This scenario represents a privilege escalation vulnerability that can be exploited by compromised administrator accounts or through social engineering attacks that gain administrative credentials.
Security mitigations for this vulnerability should focus on immediate plugin updates to versions that address the input sanitization and output escaping deficiencies. WordPress administrators should implement strict input validation measures that sanitize all user-supplied data before storage and ensure proper output escaping when rendering content. The implementation of Content Security Policy headers can provide additional protection against XSS attacks by restricting script execution within the browser environment. Regular security audits of WordPress plugins should be conducted to identify similar vulnerabilities, and administrators should maintain updated security practices including regular credential rotation and monitoring for suspicious administrative activities. This vulnerability also highlights the importance of following secure coding practices as outlined in the OWASP Top Ten and ATT&CK framework's T1212 technique for exploitation of software vulnerabilities. Organizations should implement comprehensive patch management processes to ensure timely deployment of security updates and maintain security awareness training for administrators to prevent unauthorized access that could lead to exploitation of such vulnerabilities.