CVE-2026-88793: YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server
The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
The affected versions are YouTube Embed 10.0 through 10.3 for WordPress. The issue is in an AJAX action named youram_server.
Does exploiting this require a WordPress account or special privileges?
No. The vulnerable AJAX action lacks an authorization check, so an unauthenticated attacker can exploit it. The attacker needs a nonce that is printed on every front-end page.
Who is at risk from the stored script execution?
Any user who views the affected content can have the injected script execute in their browser session. This includes WordPress administrators, whose sessions may expose higher-impact actions or data.
Is user interaction required for impact?
Yes. The injected script executes when a user views the affected content. The attacker can store the payload without authentication, but a victim must load the rendered content for the script to run.