Threats tagged 'ghsa-mwfg-r67v-rvfv'

The YouTube Embed WordPress plugin versions 10.0 through 10.3 contain a Cross-Site Scripting (XSS) vulnerability. This flaw arises because the plugin does not perform authorization checks on a specific AJAX action and relies solely on a nonce exposed on every front-end page. Additionally, it fails to escape stored data before rendering, allowing unauthenticated attackers to inject arbitrary scripts that execute in the context of any user viewing the affected content, including administrators.