The plugin allows an attacker to redirect visitors to an untrusted web address. This open redirect flaw can be exploited to facilitate phishing or other malicious campaigns by luring site users to deceptive or malware‑laden destinations. The weakness is categorized as CWE‑601 – URL Redirection to Untrusted Site.

The vulnerability applies to the WordPress WP YouTube Lyte plugin by Frank Goossens, for all releases up to and including version 1.7.28. Websites that host the plugin in these versions are at risk.

With a CVSS score of 3.4 the severity is considered low. The EPSS score of less than 1 % indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is likely via the web, where a malicious actor can manipulate a redirect parameter in the plugin’s output or administrative interface, leading unsuspecting users to malicious URLs.