CVE-2026-96895
WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
| Vendor | unknown |
| Product | wp youtube lyte |
| Published | Sep 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp youtube lyte
Be the first to know when new unknown vulnerabilities affecting unknown wp youtube lyte are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP YouTube Lyte
0 < 1.7.31
References
Credits
Dmitrii Ignatyev WPScan