This bug allows a user who can send a forged request to the ATT YouTube Widget plugin to inject arbitrary JavaScript code that is stored in the plugin’s data. Once stored, the code is executed in the browsers of anyone who visits the affected WordPress site, enabling activities such as session hijacking, credential theft, or defacement. The weakness is a classic cross‑site request forgery that results in a stored XSS condition.

WordPress sites that have the ATT YouTube Widget plugin installed at version 1.0 or earlier. The plugin is provided by the vendor thaihavnn07 and is affected for all releases up through 1.0. No other products or versions are listed.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% shows that the probability of current exploitation is very low. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Adversaries would target the plugin by crafting a CSRF request that injects malicious payloads; a successful attack therefore requires web access to the site and the ability to trigger the plugin’s input routine. Once the payload is stored, it automatically runs for every user who views the affected content, creating a persistent threat.