Description
The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field: EMD_MB_Helper::image_info() returns the attachment's raw post_title, and EMD_MB_Helper::shortcode() interpolates it into title="%s" HTML attributes via sprintf() without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above (upload_files capability required to create the attachment, edit_posts/publish_posts to embed the shortcode), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-08-16
Score: 6.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an authenticated author or higher to inject arbitrary JavaScript into pages via the emd_mb_meta shortcode. The plugin fails to escape attachment titles for the image field, letting the raw post_title appear in a title attribute without sanitization. An attacker can embed malicious scripts that will execute whenever any user views a page containing the shortcode, enabling phishing, cookie theft, defacement, or exploitation of other XSS vectors.

Affected Systems

The issue exists in the Video Gallery – YouTube Gallery, Playlist & Video Grid WordPress plugin produced by emarket‑design and affects all releases up to and including version 4.0.4. It is relevant for sites running the plugin on any WordPress installation where users can upload attachments and use the emd_mb_meta shortcode.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity with a medium exploitation likelihood. The EPSS is not listed, but the vulnerability is not in the CISA KEV catalog. Attackers need a user account with author privileges (or higher) and the ability to upload files and create shortcodes. Once the payload is embedded, it is stored and delivered to all site visitors, making the threat significant for any public-facing website that trusts author-level users.

Generated by OpenCVE AI on August 16, 2026 at 06:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Video Gallery plugin to the latest release that removes the unsanitized title usage (≥4.0.5 if available).
  • If an update is not possible, disable the emd_mb_meta shortcode for all authors or restrict it to super-administrators only.
  • Apply output escaping to the post_title by using esc_attr() before inserting it into the title attribute or by stripping HTML before storing it.
  • Review other plugin shortcodes for similar unsanitized use of attachment data and apply the same escaping practice.

Generated by OpenCVE AI on August 16, 2026 at 06:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 16 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Description The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field: EMD_MB_Helper::image_info() returns the attachment's raw post_title, and EMD_MB_Helper::shortcode() interpolates it into title="%s" HTML attributes via sprintf() without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above (upload_files capability required to create the attachment, edit_posts/publish_posts to embed the shortcode), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Video Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-16T05:27:27.630Z

Reserved: 2026-07-14T19:30:01.178Z

Link: CVE-2026-15790

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-16T06:16:50.967

Modified: 2026-08-16T06:16:50.967

Link: CVE-2026-15790

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-16T06:30:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')