CVE-2026-3299 is a stored cross-site scripting vulnerability in the WP YouTube Lyte plugin for WordPress. The issue arises from improper neutralization of user-supplied input in the 'lyte' shortcode, allowing authenticated users with contributor-level privileges or higher to inject arbitrary JavaScript code into pages. This code executes in the context of users who visit the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all plugin versions up to 1.7.29. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with contributor-level or higher access can inject malicious scripts that execute in the browsers of users viewing the infected pages. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or unauthorized actions performed on behalf of users. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider removing or disabling the WP YouTube Lyte plugin if possible. Monitor for updates from the plugin vendor or WordPress security channels for a patch or official mitigation instructions.