CVE-2026-88793 in YouTube Embed Plugin
Summary
by MITRE • 09/13/2026
The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability identified within YouTube Embed WordPress plugin versions 10.0 through 10.3 represents a critical intersection of authentication bypass and cross-site scripting flaws that fundamentally compromise the integrity of the web application environment. The core issue stems from inadequate access control mechanisms governing specific AJAX endpoints exposed by the plugin. Rather than implementing robust server-side authorization checks to verify whether the requesting user possesses the necessary privileges to execute these actions, the developers relied exclusively on a nonce for security validation. While nonces are designed to prevent cross-site request forgery attacks by ensuring that requests originate from legitimate pages within the application, this implementation fails because the nonce is printed and accessible on every front-end page of any WordPress site running the vulnerable plugin. This design flaw effectively neutralizes the protective value of the nonce for unauthenticated attackers, as they can easily retrieve a valid token simply by loading any public-facing webpage associated with the target installation. Consequently, an attacker does not need to be logged in or possess any credentials to interact with these administrative-level AJAX functions, thereby bypassing standard WordPress authentication protocols entirely.
Beyond the authorization failure, the vulnerability is exacerbated by a severe input validation and output encoding deficiency. The plugin accepts user-supplied data through these unauthenticated endpoints but fails to properly escape this stored information before rendering it in subsequent HTTP responses. This lack of sanitization allows an attacker to inject arbitrary JavaScript code into the database or configuration storage associated with the plugin's functionality. When another user, including a site administrator with elevated privileges, views content that triggers the rendering of this maliciously crafted data, the embedded scripts execute within their browser session context. This behavior classifies the vulnerability as a stored cross-site scripting issue, where the payload persists on the server and is delivered to victims automatically upon page load, rather than requiring immediate interaction or click-throughs typical of reflected XSS attacks.
The operational impact of this combined flaw set is severe, particularly given the widespread adoption of WordPress in enterprise and public-facing web environments. An unauthenticated attacker can achieve arbitrary code execution within the context of any victim's browser session. If an administrator views a compromised page, the attacker gains full control over that administrative session, potentially leading to complete website takeover, defacement, data exfiltration, or further lateral movement into backend systems. Even for standard users, the ability to execute scripts allows for cookie theft, session hijacking, and redirection to malicious phishing sites. The persistence of the payload means that every subsequent visitor becomes a potential victim until the malicious content is manually removed from the database, creating an ongoing threat vector that can compromise numerous users over time without further effort from the attacker.
From a classification perspective, this vulnerability aligns with CWE-862 for Missing Authorization and CWE-79 for Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS). The exploitation technique maps directly to MITRE ATT&CK techniques such as T1059.007 for JavaScript Execution and potentially T1136 for Create Account if the attacker leverages the session to create new privileged users. To mitigate this risk, immediate action is required by updating the YouTube Embed plugin to a version where these flaws have been patched. Administrators should ensure that all plugins are kept up-to-date with security releases from their vendors. Additionally, implementing strict Content Security Policy headers can help limit the impact of any successful XSS attempts by restricting script execution sources. Regular auditing of AJAX endpoints for proper capability checks and rigorous input sanitization practices during development phases are essential preventive measures to avoid similar vulnerabilities in future software versions.