What is GHSA-xjqr-5587-cfwc?

GHSA-xjqr-5587-cfwc is a security advisory published by GitHub Security Advisories with Medium severity. The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube...

Which CVE IDs does GHSA-xjqr-5587-cfwc cover?

GHSA-xjqr-5587-cfwc covers the following CVE IDs: CVE-2026-96895. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xjqr-5587-cfwc?

GHSA-xjqr-5587-cfwc has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-xjqr-5587-cfwcMediumCVSS 6.8

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube...

Vendor

GitHub Security Advisories

Published

September 27, 2026

Last Modified

September 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-96895 →

📋 Description

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-96895
https://wpscan.com/vulnerability/15978f11-a7bd-41f0-94bf-069be4d03987
https://github.com/advisories/GHSA-xjqr-5587-cfwc