CVE-2026-88793

HighCVSS 8.8/10Last modified Sep 14, 2026

Description

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownYouTube Embed>= 10.0, <= 10.3

References

Timeline

Published
Sep 13, 2026
Last modified
Sep 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-887948.2Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML fileCVE-2026-887959.0The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from datCVE-2026-887977.1The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it tCVE-2026-887985.3The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage keyCVE-2026-88806.4The RomanCart Ecommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blclass' attribute (and other attributes)CVE-2026-888027.5The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capaCVE-2026-888049.6An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the RanCVE-2026-888058.1Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. CVE-2026-888067.5A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.CVE-2026-888078.9A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clCVE-2026-888088.8A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own clusteCVE-2026-88817.5Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption. MD5 has