The WP YouTube Lyte plugin, a WordPress extension used to embed YouTube videos more efficiently, contains an insufficiently sanitized user input handling for the 'lyte' shortcode, which allows a contributor‑level user to inject arbitrary JavaScript into posts or pages. This stored cross‑site scripting flaw is cataloged as CWE‑79 and can compromise the confidentiality, integrity, and availability of the site by executing malicious scripts in the context of any visitor who loads a page containing the maliciously crafted shortcode.

The vulnerability affects any installation of the WP YouTube Lyte plugin version 1.7.29 or earlier. All users of the plugin on WordPress sites should verify the installed version and consider upgrading to the next release.

With a CVSS score of 6.4, the flaw is considered moderate severity. Since the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the likelihood of exploitation appears low at the moment, but the vulnerability requires authenticated access at the contributor level, which many sites grant to regular content authors. Attackers can exploit the flaw by adding or editing shortcodes after gaining contributor rights, and the injected code will run when any site visitor views the affected page.