CVE-2026-8877

Name of the Vulnerable Software and Affected Versions Responsive Video Embedder versions prior to 0.2

Description Stored Cross-Site Scripting occurs via the 'rem video' shortcode. The issue stems from insufficient input sanitization and output escaping in the video shortcode() function. Specifically, user-supplied attributes id and list are concatenated directly into an HTML iframe's src attribute without escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update Responsive Video Embedder to a version newer than 0.1. As a temporary mitigation, restrict the use of the 'rem video' shortcode or limit user permissions to prevent contributors from editing pages.