This vulnerability (CVE-2025-68599) involves improper input neutralization in the YouTube Embed plugin provided by Embeds For YouTube Plugin Support. It allows stored cross-site scripting attacks, where malicious input is saved and later executed in users' browsers. The issue affects all versions up to 5.4. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No patch or mitigation details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users interacting with the affected plugin, potentially leading to limited confidentiality, integrity, and availability impacts. This could include theft of user data, session hijacking, or other malicious actions within the scope of the affected web application. However, no known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin to reduce exposure. Monitor vendor channels for updates or patches addressing this vulnerability.