The DSGVO Youtube plugin contains an improper neutralization flaw that allows an attacker to inject scripts into the browser context via manipulated input. This DOM-based XSS can run arbitrary JavaScript within the victim’s session, enabling data theft, session hijacking, or defacement. The weakness is identified as CWE‑79.

WordPress sites that use the DSGVO Youtube plugin from any earlier releases through version 1.5.1 are affected. The plugin is authored by Eric‑Oliver Mächler. No specific operating system or WordPress core version exclusions are listed.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is less than 1 %, implying a low probability of exploitation in the wild at this time, and the issue is not currently in the CISA KEV catalog. Attackers would likely exploit this by crafting a malicious URL or form input that the plugin fails to sanitize before rendering in the DOM; the impact is limited to the scope of the user who views the compromised page, but if the attacker can target privileged or administrative users, the damage could be more extensive.