Live › vulnerability › CVE-2026-61995
YouTube Showcase versions up to and including 4.1.0 contain a cross site scripting flaw that needs no login. An attacker can get malicious script to run in a visitor's browser on a site that uses the plugin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the YouTube Showcase plugin at version 4.1.0 or earlier are exposed, because the flaw needs no account. The sources do not say which page or input is vulnerable, so whether a site is reachable depends on the plugin's features in use. Sites without the plugin, or with a newer version, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| youtube-showcase | wordpress | <= 4.1.0 | – |
WordPress admin > Plugins: look for Video Gallery – YouTube Gallery, Playlist & Video Grid (slug youtube-showcase); version 4.1.0 or earlier is affected. 4.1.0 is currently the latest release on WordPress.org, so no fixed version exists yet.
4.1.0, the affected oneEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-61995")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.