{"id":"CVE-2026-61995","kind":"vulnerability","aliases":["CVE-2026-61995"],"related":[],"title":"YouTube Showcase WordPress plugin: unauthenticated XSS through versions 4.1.0","description":"Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.","summary":"YouTube Showcase versions up to and including 4.1.0 contain a cross site scripting flaw that needs no login. An attacker can get malicious script to run in a visitor's browser on a site that uses the plugin.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"youtube-showcase","fixed":[],"affected":"<= 4.1.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["emarket-design","package","wordpress","xss","youtube-showcase"],"not_affected_if":["plugin-deactivated","plugin-not-installed"],"how_to_check":"WordPress admin > Plugins: look for 'Video Gallery – YouTube Gallery, Playlist & Video Grid' (slug youtube-showcase); version 4.1.0 or earlier is affected. 4.1.0 is currently the latest release on WordPress.org, so no fixed version exists yet.","fix":"No fixed version known: Patchstack lists no official patch and the WordPress.org changelog's newest release is 4.1.0, the affected one. Deactivate or remove the plugin until a newer release appears.","status":"open","published_at":"2026-10-29T16:18:12+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:29:55+00:00","updated_at":"2026-10-29T16:35:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:29:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"YouTube Showcase WordPress plugin: unauthenticated XSS through versions 4.1.0","impact":"medium","summary":"YouTube Showcase versions up to and including 4.1.0 contain a cross site scripting flaw that needs no login. An attacker can get malicious script to run in a visitor's browser on a site that uses the plugin.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","youtube-showcase"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers on the site","analyst_note":"Find the vulnerable input and the fixed version from the NVD entry and the plugin's changelog (https://nvd.nist.gov/vuln/detail/CVE-2026-61995).","how_to_check":"- Check the installed version of YouTube Showcase in the WordPress admin plugin list, or in the plugin's main file header.\n- Treat any version `4.1.0` or earlier as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the YouTube Showcase plugin at version 4.1.0 or earlier are exposed, because the flaw needs no account. The sources do not say which page or input is vulnerable, so whether a site is reachable depends on the plugin's features in use. Sites without the plugin, or with a newer version, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":4070,"output_tokens":560,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vulnerable input and the fixed version from the NVD entry and the plugin's changelog (https://nvd.nist.gov/vuln/detail/CVE-2026-61995).","search":"'-2026':11A,14A '-61995':12A,15A '4.1.0':9A,35B,74C 'attack':47B 'browser':58B 'contain':36B 'cross':38B,67C 'cve':10A,13A 'design':21B 'emarket':20B 'emarket-design':19B 'flaw':41B 'get':49B 'includ':34B 'login':45B 'malici':50B 'need':43B 'packag':22B 'plugin':4A,65B 'run':53B 'script':40B,51B,69C 'showcas':2A,27B,29B,73C 'showcase':18A 'site':39B,61B,68C 'unauthent':5A,66C 'use':63B 'version':8A,30B,75C 'visitor':56B 'wordpress':3A,23B 'xss':6A,24B,70C 'youtub':1A,26B,28B,72C 'youtube':17A 'youtube-showcas':25B 'youtube-showcase':16A","nicknames":[],"mitigations":[],"who_affected":"Sites running the YouTube Showcase plugin at version 4.1.0 or earlier are exposed, because the flaw needs no account. The sources do not say which page or input is vulnerable, so whether a site is reachable depends on the plugin's features in use. Sites without the plugin, or with a newer version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61995","severity":null,"published_at":"2026-10-29T16:18:12+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-61995:1069","url":null,"severity":null,"published_at":"2026-10-29T16:35:59+00:00","modified_at":"2026-10-29T16:35:59+00:00","first_seen_at":"2026-10-29T16:35:59+00:00","fetched_at":"2026-10-29T16:35:59+00:00","note":"Patchstack (CNA) says <= 4.1.0, unauthenticated XSS, user interaction required, no patch; wp.org latest is 4.1.0. Vulnerable input not published. Vendor has not confirmed; nothing marked verified. Not exploited per sources. Recheck wp.org changelog for 4.1.1+."}],"documents":[{"id":17791,"url":"https://wordpress.org/plugins/youtube-showcase/","title":"YouTube Showcase on WordPress.org (changelog; latest 4.1.0)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":17792,"url":"https://patchstack.com/database/wordpress/plugin/youtube-showcase/vulnerability/wordpress-youtube-showcase-plugin-4-1-0-cross-site-scripting-xss-vulnerability","title":"Patchstack: YouTube Showcase <= 4.1.0 XSS, no official patch","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}