Reflected Cross-site Scripting Vulnerability in NotFound Youtube Video Grid Plugin
CVE-2025-23634

7.1HIGH

Key Information:

Vendor

WordPress
Status
Youtube Video Grid
Vendor
CVE Published:
23 January 2025

What is CVE-2025-23634?

A Cross-site Scripting (XSS) vulnerability exists in the NotFound Youtube Video Grid plugin, allowing attackers to inject malicious scripts via user input that is improperly handled during web page generation. This issue affects all versions up to 1.9, potentially compromising the security of web applications that utilize this plugin. Action should be taken to mitigate exposure to this vulnerability.

Affected Version(s)

Youtube Video Grid <= 1.9

References

https://patchstack.com/database/wordpress/plugin/youmax-c...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

thiennv (Patchstack Alliance)
.
CVE-2025-23634 : Reflected Cross-site Scripting Vulnerability in NotFound Youtube Video Grid Plugin