The YouTube Embed WordPress plugin, versions 10.0 through 10.3, contains an unauthenticated stored XSS vulnerability. An AJAX action that the plugin exposes accepts user‑supplied data without performing an authorization check and does not escape the data before rendering it. When an attacker submits malicious JavaScript via this action, the payload is stored in the plugin’s data store and later delivered to any visitor of the affected content, including administrators. The flaw therefore permits attackers to execute scripts in the browsers of all to session hijacking, credential theft, defacement, or delivery of malware.

All WordPress sites that have installed the YouTube Embed plugin between versions 10.0 and 10.3 are vulnerable. Because the plugin’sTube Embed should treat the site as affected.

A CVSS score of 8.8 indicates a high severity. The EPSS score of less than 1 % suggests that, at the time of this analysis, the probability of exploitation is low but non‑zero. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw from any internet‑connected location by sending a crafted request to the vulnerable AJAX endpoint; a valid nonce generated on the front‑end is sufficient to bypass the check, so no authentication is required.