CVE-2026-1608

Name of the Vulnerable Software and Affected Versions Video Onclick plugin for WordPress versions prior to 0.4.8

Description The Video Onclick plugin for WordPress is susceptible to Stored Cross-Site Scripting through the youtube shortcode. This is due to inadequate input sanitization and output escaping of user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute each time a user views the affected page. The vulnerable component is the youtube shortcode.

Recommendations Update the Video Onclick plugin to version 0.4.8 or later.