CVE-2026-96895

Name of the Vulnerable Software and Affected Versions WP YouTube Lyte WordPress plugin versions prior to 1.7.31

Description Insufficient escaping of attributes within YouTube embed blocks occurs during the rendering process when they are outputted into an HTML attribute. This flaw allows users with contributor-level permissions to execute Stored Cross-Site Scripting (XSS) attacks, a technique where malicious scripts are permanently stored on the target server and served to other users.

Recommendations Update the plugin to version 1.7.31 or later.