Security Alert Summary
The Video Onclick plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its youtube shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated users with contributor-level access and above can inject scripts that execute when an affected page is viewed by other users.
CVE Details
- CVE ID: CVE-2026-1608
- Affected plugin / component: Video Onclick plugin for WordPress
- Affected versions: all versions up to, and including, 0.4.7
- Published: February 7, 2026 at 9:16 AM UTC
- Last modified: February 7, 2026 at 9:16 AM UTC
- CVSS v3.1: Base score 6.4 (MEDIUM); Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / Privileges / User Interaction: The vulnerability can be exploited by authenticated attackers with contributor-level access and above. Privileges Required: Low. User Interaction: None.
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE / weakness ID: CWE-79
Technical Details
The plugin’s youtube shortcode does not sufficiently sanitize or escape user-supplied attributes before storing and rendering them. Because the input is stored and later output into pages, an authenticated user with contributor-level privileges (or higher) can insert malicious JavaScript payloads that are saved in the site content.
When another user visits a page containing the injected shortcode output, the browser will execute the stored script in the context of that page. The CVE description attributes the root cause to insufficient input sanitization and output escaping on user-supplied attributes. The vulnerability is a stored (persistent) Cross-Site Scripting issue and operates within the limits indicated by the CVSS impacts (confidentiality and integrity have low impact; availability is not impacted).
How This Could Impact Your Website
Consider a site where an external contractor or contributor can add content using the plugin’s shortcode. A contributor could insert a payload into a page or post using the youtube shortcode. When internal staff or the site owner view that page, the injected script can run in their browsers. Practical consequences include disclosure of information visible to the viewing user (for example, email addresses displayed on a page), modification of content presented to viewers, or facilitating targeted phishing or social engineering against staff who see the injected content. These impacts align with the CVSS ratings indicating low confidentiality and integrity impact rather than total account takeover.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles, especially contributor-level accounts that can create or edit content.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual behavior, new or unexpected posts/pages, and changes to existing content.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
