CVE-2023-4841

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Feeds for YouTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube-feed' shortcode in versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
smub	Feeds for YouTube (YouTube video, channel, and gallery plugin)	<= 2.1

References

https://plugins.trac.wordpress.org/browser/feeds-for-youtube/tags/2.1/templates/feed.php#L33Issue Tracking
https://plugins.trac.wordpress.org/changeset/2966017/feeds-for-youtube#file564Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/376e2638-a873-4142-ad7d-067ae3333709?source=cveExploit, Third Party Advisory
https://plugins.trac.wordpress.org/browser/feeds-for-youtube/tags/2.1/templates/feed.php#L33Issue Tracking
https://plugins.trac.wordpress.org/changeset/2966017/feeds-for-youtube#file564Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/376e2638-a873-4142-ad7d-067ae3333709?source=cveExploit, Third Party Advisory

Timeline

Published: Sep 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-484107.5In cd_ParseMsg of cd_codec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information di CVE-2023-484115.5In SignalStrengthAdapter::FillGsmSignalStrength() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds CVE-2023-484125.5In private_handle_t of mali_gralloc_buffer.h, there is a possible information leak due to a logic error in the code. This could lead to loc CVE-2023-484134.9In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informati CVE-2023-484146.7In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code. This could lead to local escalation of priv CVE-2023-484155.5In Init of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local informat CVE-2023-484167.5In multiple locations, there is a possible null dereference due to a missing null check. This could lead to remote denial of service with no CVE-2023-484179.8Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application CVE-2023-484187.8In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecur CVE-2023-484199.8An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege CVE-2023-48425.4The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode CVE-2023-484206.4there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privilege