CVE-2026-88793

The YouTube Embed WordPress plugin versions 10.0 to 10.3 performs no authorisation check on one of its AJAX actions, with its only safeguard being a nonce that is printed on every front-end page, so any unauthenticated visitor can retrieve the nonce and invoke the action. Because the plugin also fails to escape stored data before rendering it, an attacker can persist arbitrary web scripts that execute in the browser of any user viewing the affected content, including administrators, enabling session hijacking and full site takeover. Any WordPress site running the plugin in the 10.0–10.3 range is affected. There is no known public PoC and the flaw is not listed in CISA's KEV, so exploitation is currently none known.

What to do: Update to version 10.4 or later (or the latest release) immediately. Inspect the plugin's stored options and rendered embed content for injected scripts and log out/rotate admin sessions if tampering is found. If updating is not possible, deactivate and remove the plugin and review server logs for unauthenticated AJAX requests to the affected action.