CVE-2026-15790

Name of the Vulnerable Software and Affected Versions Youtube Showcase versions prior to 4.0.5

Description Stored Cross-Site Scripting occurs via the emd mb meta shortcode due to insufficient input sanitization and output escaping on attachment titles. The function EMD MB Helper::image info() returns the raw post title of an attachment, which is then interpolated into HTML attributes by EMD MB Helper::shortcode() using sprintf() without the use of esc attr(). Authenticated attackers with author-level access or higher, possessing upload files, edit posts, and publish posts capabilities, can inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update Youtube Showcase to a version newer than 4.0.4.