The vulnerability is an insufficiently sanitized input in the instance parameter of the YouTube Embed WordPress plugin, allowing an authenticated attacker with Contributor level access or higher to inject arbitrary JavaScript. Because the payload is stored and served to all users who view the page, the impact is broad, granting attackers the ability to hijack user sessions, deface content, or otherwise compromise user integrity. This weakness is a classic stored XSS scenario.

The affected product is the "YouTube Embed – YouTube Gallery, Vimeo Gallery" plugin from hanucodes for WordPress. All releases up to and including version 10.3 are impacted. WordPress sites that have installed or rely on these plugin versions and grant Contributor or higher permissions are vulnerable.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low but nonzero likelihood of real‑world exploitation at the time of analysis. The vulnerability is not currently listed in the CISA KEV catalog. The attack requires authenticated access to the WordPress admin area, so the typical path involves a legitimate contributor account being used to submit malicious content through the instance field. Because the malicious script is stored, once placed it will execute on subsequent page loads for any visitor to the affected page.