VULNERABILITY INTELLIGENCE

CVE-2026-15790

CVSS score6.4 MEDIUM

EPSS probability0.32%

CISA KEVNot currently listed

Published2026-08-16

Last modified2026-08-20

Description

The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field: EMD_MB_He…