YouTube Showcase
YouTube Showcase displays YouTube videos and video collections on WordPress websites.
YouTube Showcase (youtube-showcase) is a WordPress plugin with 6 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 8.1.
youtube-showcaseCVE-2026-61995: YouTube Showcase: Cross-site scripting
Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is n/a through 4.1.0.
| Safe version |
|
||
|---|---|---|---|
| Oct 29, 2026 |
CVE-2026-61995
YouTube Showcase: Cross-site scripting
Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is n/a through 4.1.0.
|
See mitigation notes |
CVE7.1
|
| Aug 16, 2026 |
CVE-2026-15790
YouTube Showcase attachment titles permit Author stored XSS
YouTube Showcase through 4.0.4 lets an Author create an attachment whose post_title contains an attribute-breaking payload, then reference it through the emd_mb_meta shortcode. EMD_MB_Helper::image_info() returns the raw title and EMD_MB_Helper::shortcode() inserts it into title="%s" with sprintf() but without esc_attr(). The script executes for visitors to the rendered page. The exact reporter payload is not disclosed.
|
4.0.5 |
CVE6.4
|
| Jul 01, 2026 |
CVE-2026-12923
Video Gallery – YouTube Gallery, Playlist & Video Grid: Sensitive information exposure
Video Gallery – YouTube Gallery, Playlist & Video Grid is affected by sensitive information exposure. Exploitation requires an authenticated subscriber account. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 4.0.3.
|
4.0.4 |
CVE7.5
|
| Apr 15, 2026 |
CVE-2025-15636
YouTube Showcase: Cross-site scripting
YouTube Showcase is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.5.1.
|
3.5.2 |
CVE6.5
|
| Aug 28, 2025 |
CVE-2025-54731
YouTube Showcase: Code execution
YouTube Showcase is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.1
|
| Oct 03, 2023 |
CVE-2023-40558
Youtube Showcase: Cross-site request forgery
Youtube Showcase is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.4
|