WordPress YouTube Showcase plugin suffers from PHP Object Injection that enables attackers to inject arbitrary PHP code. The flaw arises from improper validation of user‑controlled data during object deserialization, exposing the plugin to code injection. This is a CWE‑94 vulnerability that can compromise confidentiality, integrity and availability by allowing attackers to execute arbitrary code on the affected host.

All installations of the YouTube Showcase plugin from emarket-design, from the earliest release through version 3.5.1, are affected. No specific operating system or PHP version restrictions are listed, so any WordPress site running a vulnerable plugin instance is at risk.

The CVSS score of 8.1 places the flaw in the high‑severity range, and the EPSS score of less than 1% suggests exploit attempts are rare but not impossible. The variant is not listed in the CISA KEV catalog, indicating no widespread public exploitation known at this time. Attackers could potentially trigger the injection by submitting specially crafted input to the plugin’s endpoints, likely requiring user authentication or access to the plugin’s administration interface. Successful exploitation would give the attacker full PHP execution capability on the web server.