CVE-2021-24419

The WP YouTube Lyte WordPress plugin before 1.7.16 did not sanitise or escape its lyteytapikey and lytenotification settings before outputting them back in the page, allowing high privilege users to set XSS payload on them and leading to stored Cross-Site Scripting issues...

CVE-2021-24419 WP YouTube Lyte < 1.7.16 - Authenticated Stored XSS

The WP YouTube Lyte WordPress plugin before 1.7.16 did not sanitise or escape its lyteytapikey and lytenotification settings before outputting them back in the page, allowing high privilege users to set XSS payload on them and leading to stored Cross-Site Scripting issues...

CVE-2021-24419

Summary: CVE-2021-24419 affects the WordPress WP YouTube Lyte plugin versions before 1.7.16. The root cause is failure to sanitize/escape the lyte_yt_api_key and lyte_notification settings before output, enabling authenticated, high-privilege users to inject stored XSS payloads. Impact: stored Cr...