CVE-2026-3299

WP YouTube Lyte <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcode

Published Apr 16, 2026 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The WP YouTube Lyte plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lyte' shortcode in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

The WP YouTube Lyte plugin, a WordPress extension used to embed YouTube videos more efficiently, contains an insufficiently sanitized user input handling for the 'lyte' shortcode, which allows a contributor‑level user to inject arbitrary JavaScript into posts or pages. This stored cross‑site scripting flaw is cataloged as CWE‑79 and can compromise the confidentiality, integrity, and availability of the site by executing malicious scripts in the context of any visitor who loads a page containing the maliciously crafted shortcode.

Affected Systems

The vulnerability affects any installation of the WP YouTube Lyte plugin version 1.7.29 or earlier. All users of the plugin on WordPress sites should verify the installed version and consider upgrading to the next release.

Risk and Exploitability

With a CVSS score of 6.4, the flaw is considered moderate severity. Since the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the likelihood of exploitation appears low at the moment, but the vulnerability requires authenticated access at the contributor level, which many sites grant to regular content authors. Attackers can exploit the flaw by adding or editing shortcodes after gaining contributor rights, and the injected code will run when any site visitor views the affected page.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

futtta

WP YouTube Lyte

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.7.29

No data.

Vendor Product Versions

Futtta

Wp Youtube Lyte

Version	Status	Scheme	Platform
`[0,1.7.29]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the WP YouTube Lyte plugin to the latest release that resolves the shortcode sanitization issue.
Inspect existing posts, pages, and custom content for occurrences of the lyte shortcode with suspicious attributes and either sanitize or delete the malicious entries before publishing.
If an immediate upgrade is not possible, restrict contributor‑level users from editing content that includes the lyte shortcode, or use a security plugin to block shortcode usage for certain user roles.

Generated by OpenCVE AI on April 16, 2026 at 02:11 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.222% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/3482595/wp-youtube-lyte
https://www.wordfence.com/threat-intel/vulnerabilities/id/de09d051-d124-4397-bd1c-b193acd6c186?source=cve

History

Apr 16, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 16, 2026 9:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Futtta Futtta wp Youtube Lyte Wordpress Wordpress wordpress
Vendors & Products		Futtta Futtta wp Youtube Lyte Wordpress Wordpress wordpress

Apr 16, 2026 1:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The WP YouTube Lyte plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lyte' shortcode in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		WP YouTube Lyte <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcode
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/changeset/3482595/wp-youtube-lyte https://www.wordfence.com/threat-intel/vulnerabilities/id/de09d051-d124-4397-bd1c-b193acd6c186?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`