Threat Entry Updated 2026-04-16

CVE-2026-3299 - Wp Youtube Lyte Plugin

The WP YouTube Lyte plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lyte' shortcode in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wp Youtube Lyte

CVE-2026-3299

MEDIUM CVSS 6.4 2026-04-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24419 - Wp Youtube Lyte Plugin

The WP YouTube Lyte WordPress plugin before 1.7.16 did not sanitise or escape its lyte_yt_api_key and lyte_notification settings before outputting them back in the page, allowing high privilege users to set XSS payload on them and leading to stored Cross-Site Scripting issues.

PLUGIN Wp Youtube Lyte

CVE-2021-24419

MEDIUM CVSS 4.8 2021-07-12

Risk Score

Open Full Technical Breakdown