WordPress Plugin Vulnerabilities

WP YouTube Lyte < 1.7.16 - Authenticated Stored XSS

Description

The plugin did not sanitise or escape its lyte_yt_api_key and lyte_notification settings before outputting them back in the page, allowing high privilege users to set XSS payload on them and leading to stored Cross-Site Scripting issues.

Proof of Concept

Affects Plugins

Plugin icon
wp-youtube-lyte
Fixed in 1.7.16

References

CVE
CVE-2021-24419
URL
https://m0ze.ru/vulnerability/[2021-05-03]-[WordPress]-[CWE-79]-WP-YouTube-Lyte-WordPress-Plugin-v1.7.15.txt

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.8 (medium)

Miscellaneous

Original Researcher
m0ze
Submitter
m0ze
Submitter website
https://m0ze.ru/
Submitter twitter
vladm0ze
Verified
Yes
WPVDB ID
0eeff1ee-d11e-4d52-a032-5f5bd8a6a2d7

Timeline

Publicly Published
2021-06-16 (about 4 years ago)
Added
2021-06-16 (about 4 years ago)
Last Updated
2021-06-25 (about 4 years ago)

Other

Published
Title
Published
2024-08-01
Title
Kubio AI Page Builder < 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2012-05-15
Title
Sharebar <= 1.2.1 - SQL Injection & Cross-Site Scripting (XSS)
Published
2025-06-25
Title
Modern Design Library < 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
Published
2025-04-04
Title
Chamber Dashboard Business Directory <= 3.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-12-02
Title
Customize Login Image < 3.5.3 - Admin+ Stored Cross-Site Scripting