Vulnerabilities > CVE-2021-24419 - Unspecified vulnerability in WP Youtube Lyte Project WP Youtube Lyte
Attack vector
NETWORK Attack complexity
LOW Privileges required
HIGH Confidentiality impact
LOW Integrity impact
LOW Availability impact
NONE Summary
The WP YouTube Lyte WordPress plugin before 1.7.16 did not sanitise or escape its lyte_yt_api_key and lyte_notification settings before outputting them back in the page, allowing high privilege users to set XSS payload on them and leading to stored Cross-Site Scripting issues.
Vulnerable Configurations
References
- https://m0ze.ru/vulnerability/%5B2021-05-03%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-YouTube-Lyte-WordPress-Plugin-v1.7.15.txt
- https://m0ze.ru/vulnerability/%5B2021-05-03%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-YouTube-Lyte-WordPress-Plugin-v1.7.15.txt
- https://wpscan.com/vulnerability/0eeff1ee-d11e-4d52-a032-5f5bd8a6a2d7
- https://wpscan.com/vulnerability/0eeff1ee-d11e-4d52-a032-5f5bd8a6a2d7