CVE-2025-54731

CVE-2025-54731 affects the WordPress plugin YouTube Showcase (versions up to 3.5.1). Root cause: improper control of generation of code, enabling PHP object injection . Impact: high risk with network exposure (CVSS v3.1 base 8.1; AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected product: YouTube Sho...

CVE-2025-54731 WordPress YouTube Showcase Plugin <= 3.5.1 - PHP Object Injection Vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in emarket-design YouTube Showcase allows Object Injection. This issue affects YouTube Showcase: from n/a through 3.5.1...

CVE-2025-54731 WordPress YouTube Showcase Plugin <= 3.5.1 - PHP Object Injection Vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue affects YouTube Showcase: from n/a through = 3.5.1...

CVE-2025-48359

CVE-2025-48359 describes a CSRF to Stored XSS in the WordPress ATT YouTube Widget (versions up to and including 1.0). The root cause is CSRF protection gaps that permit stored XSS when the widget is interacted with or data is submitted, potentially enabling an attacker to inject script that is st...

CVE-2025-48359 WordPress ATT YouTube Widget plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a through = 1.0...

CVE-2025-48349

CVE-2025-48349 is a stored XSS in the WordPress add-on Video Gallery – Vimeo and YouTube Gallery (origincode) affecting versions up to and including 1.1.7. The vulnerability stems from improper input neutralization during web page generation, enabling stored cross-site scripting. Public reference...

CVE-2025-48349 WordPress Video Gallery – Vimeo and YouTube Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in origincode Video Gallery – Vimeo and YouTube Gallery smart-grid-gallery allows Stored XSS.This issue affects Video Gallery – Vimeo and YouTube Gallery: from n/a through = 1.1.7...

Malicious code in youtube-new (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41801 Malicious code in youtube-new (PyPI)

--- -= Per source details. Do not edit below this line.=-...

PT-2025-35018

Name of the Vulnerable Software and Affected Versions: origincode Video Gallery – Vimeo and YouTube Gallery versions through 1.1.7 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to a Stored Cross-site Scripting condition...

PT-2025-35027

Name of the Vulnerable Software and Affected Versions: thaihavnn07 ATT YouTube Widget versions through 1.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists in the thaihavnn07 ATT YouTube Widget, which can lead to Stored Cross-Site Scripting XSS. Recommendations: Update...

WordPress plugin ATT YouTube Widget 跨站请求伪造漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress plugin ATT YouTube Widget, no detaile...

CVE-2025-48359: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a through = 1.0...

CVE-2025-48349: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in origincode Video Gallery – Vimeo and YouTube Gallery smart-grid-gallery allows Stored XSS.This issue affects Video Gallery – Vimeo and YouTube Gallery: from n/a through = 1.1.7...

CVE-2025-54731: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue affects YouTube Showcase: from n/a through = 3.5.1...

WordPress plugin YouTube Showcase 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

WordPress plugin Video Gallery – Vimeo and YouTube Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress YouTube Showcase Plugin <= 3.5.1 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by astra.r3verii in WordPress Plugin YouTube Showcase versions = 3.5.1...

A week in security (August 18 &#8211; August 24)

Last week on Malwarebytes Labs: Clickjack attack steals password managers’ secrets Grok chats show up in Google searches All Apple users should update after company patches zero-day vulnerability in all platforms Google settles YouTube lawsuit over kids’ privacy invasion and data collection...

PT-2025-35074

Name of the Vulnerable Software and Affected Versions YouTube Showcase versions through 3.5.1 Description An improper control of generation of code 'Code Injection' vulnerability exists in emarket-design YouTube Showcase, allowing Object Injection. Recommendations Update YouTube Showcase to a...