CVE-2023-4841 in Feeds for YouTube Plugin
Summary
by MITRE • 09/14/2023
The Feeds for YouTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube-feed' shortcode in versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/10/2026
The Feeds for YouTube plugin for WordPress represents a critical security vulnerability through its stored cross-site scripting flaw identified as CVE-2023-4841. This vulnerability affects versions up to and including 2.1 of the plugin, creating a persistent threat vector that can be exploited by authenticated attackers holding contributor-level permissions or higher. The vulnerability specifically manifests through the 'youtube-feed' shortcode implementation, which fails to properly sanitize user-supplied input attributes before processing them within the plugin's functionality.
The technical root cause of this vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase. When administrators or users with contributor privileges create or modify content using the youtube-feed shortcode, the plugin does not sufficiently validate or escape the attributes provided by users. This allows malicious input to be stored within the WordPress database and subsequently executed whenever affected pages are rendered. The vulnerability classification aligns with CWE-79 which describes Cross-Site Scripting flaws, specifically those involving stored payloads that persist in the application's data storage.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with the capability to compromise user sessions and potentially escalate privileges within the WordPress environment. Attackers can craft malicious payloads that will execute whenever legitimate users access pages containing the injected scripts, creating a persistent threat that can affect any user who views the compromised content. This stored XSS vulnerability particularly targets the plugin's shortcode functionality, which is commonly used to embed YouTube content within WordPress pages, making it a high-value target for exploitation.
The security implications of CVE-2023-4841 align with ATT&CK technique T1546.001 which covers the use of registry run keys and startup folder for persistence. While this specific vulnerability doesn't directly implement persistence mechanisms, it creates the foundation for more sophisticated attacks by enabling attackers to establish a foothold through malicious script injection. The vulnerability also intersects with ATT&CK technique T1203 which covers exploitation of remote services, as it allows attackers to exploit the WordPress plugin ecosystem to gain unauthorized access to user sessions and data.
Mitigation strategies for this vulnerability should include immediate plugin updates to versions that address the sanitization and escaping deficiencies. WordPress administrators should ensure that all users with contributor-level permissions or higher are properly vetted and that appropriate access controls are maintained. Additionally, implementing Content Security Policy headers can provide additional protection against script execution, though this serves as a supplementary defense rather than a complete solution. Regular security audits of installed plugins should be conducted to identify similar vulnerabilities, with particular attention to plugins that handle user-supplied content through shortcodes or similar mechanisms. Organizations should also consider implementing automated monitoring systems that can detect anomalous script injection patterns within their WordPress environments, as this vulnerability represents a classic example of how insufficient input validation can lead to persistent security threats.