CVE-2026-61995: WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The issue is described as unauthenticated, so exploitation does not require an attacker to have a WordPress account or plugin-specific privileges. User interaction is required for the XSS payload to have an effect.

Q: Which installations are affected?

YouTube Showcase versions up to and including 4.1.0 are identified as affected. The provided data does not state whether a particular plugin configuration or WordPress configuration is required.

Q: What impact can successful exploitation have?

The supplied severity vector indicates network-reachable exploitation with low attack complexity and user interaction required. It also indicates low confidentiality, integrity, and availability impact, with the potential impact extending beyond the vulnerable security authority.

Published Oct 29, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

Event History

Oct 29, 2026

CVE Published

via MITRE·03:24 PM

Data Sourced

via MITRE·03:24 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The issue is described as unauthenticated, so exploitation does not require an attacker to have a WordPress account or plugin-specific privileges. User interaction is required for the XSS payload to have an effect.

Which installations are affected?

YouTube Showcase versions up to and including 4.1.0 are identified as affected. The provided data does not state whether a particular plugin configuration or WordPress configuration is required.

What impact can successful exploitation have?

The supplied severity vector indicates network-reachable exploitation with low attack complexity and user interaction required. It also indicates low confidentiality, integrity, and availability impact, with the potential impact extending beyond the vulnerable security authority.

CVE-2026-61995: WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What impact can successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What impact can successful exploitation have?