The YouTube Embed WordPress plugin is vulnerable to unauthenticated stored cross-site scripting (XSS), potentially allowing attackers to hijack sessions of users, including administrators.

The plugin does not perform authorization checks on AJAX actions and relies incorrectly on a front-end nonce. It fails to escape stored data, allowing unauthenticated attackers to inject malicious scripts that execute in the sessions of visitors or administrators.

This vulnerability is assigned a CVSS score of 8.8, reflecting its high potential for exploitation. By targeting the sessions of administrators, attackers could gain unauthorized access to the WordPress dashboard, leading to data theft, malware distribution, or site defacement.

Immediate Action: Deactivate or remove the YouTube Embed plugin until the developer provides a version that includes proper authorization and output escaping.

Proactive Monitoring: Monitor for suspicious activity in user sessions and check for unexpected modifications to embedded content or site pages.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block XSS attempts in AJAX-based requests.

Public Exploit Available: No

Given the risk of administrative session hijacking, it is imperative to remove the vulnerable plugin from production environments immediately. Organizations should rely on alternative methods for embedding media until a secure update is verified and deployed.