CVE-2026-96895: WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes
Published Sep 27, 2026
·Updated
The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
Affected Software
1 affected component
Frank Goossens WP YouTube Lyte<1.7.31
Event History
Sep 27, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
Which users can exploit this issue?
Users with the Contributor role or higher can exploit the issue by supplying crafted YouTube embed block attributes. The vulnerable plugin does not escape certain attributes before rendering them into an HTML attribute.
2
Which plugin versions are affected?
WP YouTube Lyte versions earlier than 1.7.31 are affected. Updating to version 1.7.31 or later addresses the affected version range.