CVE-2025-31744: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in wpszaki Lightweight and Responsive Youtube Embed plugin through version 1.0.0. The vulnerability was discovered and reported by SOPROBRO, and was publicly disclosed on April 1, 2025. This security issue affects the WordPress plugin Lightweight and Responsive Youtube Embed and requires Contributor or higher privileges to exploit (Patchstack).

The vulnerability has been assigned CVE-2025-31744 and received a CVSS v3.1 Base Score of 6.5 (Medium severity). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating that the vulnerability is network-accessible, requires low attack complexity, needs low privileges, requires user interaction, and has a changed scope with low impact on confidentiality, integrity, and availability (NVD).

The vulnerability could allow a malicious actor with contributor-level access to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

No official fix is available for this vulnerability. The recommended mitigation is to remove and replace the software with an alternative solution, as the plugin is considered abandoned and unlikely to receive future updates or security fixes (Patchstack).