The emarket-design YouTube Showcase plugin versions up to 3.5.1 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers when they view affected pages. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, required privileges, and user interaction, with impacts on confidentiality, integrity, and availability. No official remediation or patch information is currently available, and no exploits are known in the wild.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users' browsers, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium severity with partial impacts on confidentiality, integrity, and availability. No evidence of active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider applying any available temporary mitigations recommended by the vendor. Monitoring for updates from emarket-design is advised.