The vulnerability exists in the WordPress plugin ‘kk Youtube Video’ where user supplied attributes in the ‘kkytv’ shortcode are not properly sanitized or escaped. This deficiency permits an authenticated user with contributor level access or higher to inject arbitrary scripts that are then stored and executed whenever the corresponding page is viewed. The impact is the ability to run attacker‑controlled code in the browser context of any user who visits the affected page, raising risks of defacement, credential theft, or session hijacking. It is a classic input validation weakness identified as CWE‑79.

This flaw affects the WordPress plugin ‘kk Youtube Video’ versions 0.2 and earlier, distributed by the vendor bhittani. Any WordPress installation running the plugin at or below 0.2 is potentially vulnerable.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% implies a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with contributor or higher permissions. The attacker would insert malicious payload via the ‘kkytv’ shortcode, which is then rendered in the page content and executed in the browsers of visitors. Once exploited, the attacker can perform client‑side attacks such as phishing, session hijacking, or defacement. The primary attack vector is via authenticated plugin use; no remote code execution or privilege escalation beyond the attacker’s existing contributor level is observed.