← CVE Intelligence

CVE-2021-24471

YouTube Embed < 5.2.2 - Contributor+ Stored XSS PUBLISHED

Description (CNA)

The YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes, leading to Stored XSS issues by 1. using w, h, controls, cc_lang, color, language, start, stop, or style parameter of youtube shortcode, 2. by using style, class, rel, target, width, height, or alt parameter of youtube_thumb shortcode, or 3. by embedding a video whose title or description contains XSS payload (if API key is configured).

Affected (CNA)

Vendor / productVersions
Unknown / YouTube Embedaffected 5.2.2 before 5.2.2

CWE

CWE-79

References

ADP enrichment

CVE

No English description supplied.