The vulnerability arises from improper neutralization of input during web page generation, allowing stored XSS content to be inserted into the Enhanced YouTube Shortcode output. Once injected, an attacker could run arbitrary JavaScript in the victim’s browser, enabling session hijacking, cookie theft, defacement, or delivery of further malware. The weakness is a classic Stored XSS, classified as CWE‑79, and impacts the confidentiality, integrity, and availability of the affected website’s content.

WordPress plugin Le‑Pixel‑Solitaire Enhanced YouTube Shortcode, affecting all releases up to and including version 2.0.1.

The CVSS score of 6.5 indicates a moderate severity vulnerability, while the EPSS score of less than 1 % suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to the plugin’s content editor, either by an authenticated user with permission to add or edit shortcodes or, if the plugin allows public submission, by an anonymous user. The attack path involves crafting malicious shortcode content that is stored and later served to visitors, potentially allowing widespread compromise of site visitors.