UNKNOWN NVD

CVE-2026-96895

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rend

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.

References

https://wpscan.com/vulnerability/15978f11-a7bd-41f0-94bf-069be4d03987/

Published: 2026-09-27 · Source: NVD · Feed updated: 2026-09-27

This unknown severity vulnerability was published on 2026-09-27 via NVD.

vulnfeed aggregates 11720 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.