The vulnerability allows an authenticated user with Contributor-level or higher permissions to inject arbitrary JavaScript into stored data using the ‘channel’, ‘layout’, and ‘subs_count’ parameters of the Get Youtube Subs plugin. When a user visits a page that includes this malicious content, the script runs in their browser, potentially giving the attacker access to the visitor’s session cookies, personal data, or allowing unauthorized actions. This is a classic stored XSS flaw (CWE‑79).

The affected product is the WordPress plugin Get Youtube Subs, developed by zohaib167. All released versions up to and including 3.5 are vulnerable. The specific environment is a WordPress site running this plugin; no broader platform versions are mentioned.

The CVSS score of 6.4 indicates a moderate to high severity. The EPSS score of < 1% shows a very low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through authenticated access: a user logs in with Contributor or higher privileges, manipulates the plugin’s parameters to store malicious scripts, and then an unsuspecting visitor triggers the script when viewing the affected page. Because the flaw is stored, the exploit does not need to rely on additional user interaction beyond site visitation. The risk is therefore contingent on the presence of contributor privileges and the use of the vulnerable plugin on a public site.