CVE-2026-15790 is a stored Cross-Site Scripting vulnerability in the Youtube Showcase WordPress plugin (Video Gallery – YouTube Gallery, Playlist & Video Grid) versions <=4.0.4. The flaw is due to insufficient sanitization and escaping of attachment post titles used in the 'emd_mb_meta' shortcode. The function EMD_MB_Helper::image_info() returns the raw post_title, and EMD_MB_Helper::shortcode() inserts this title into HTML attributes without proper escaping (missing esc_attr()), enabling script injection. Exploitation requires authenticated users with author-level permissions or higher, who can upload files and embed the shortcode, to inject malicious scripts that execute in the context of users viewing the injected pages.

An attacker with author-level access or higher can inject arbitrary JavaScript into pages via crafted attachment titles. This can lead to execution of malicious scripts in the browsers of users visiting those pages, potentially resulting in session hijacking, defacement, or other client-side attacks. The vulnerability does not affect unauthenticated users directly but relies on compromised or malicious authenticated users with specific capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access and above to trusted users only. Review and sanitize attachment titles before embedding them in pages. Monitor for plugin updates from emarket-design addressing this vulnerability and apply them promptly once released.