What’s Vulnerable › Vulnerabilities

CVE-2021-24419: WP YouTube Lyte < 1.7.16 - Authenticated Stored XSS

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-07-12 · updated 2026-06-17
• Weakness: CWE-79

Description

The WP YouTube Lyte WordPress plugin before 1.7.16 did not sanitise or escape its lyte_yt_api_key and lyte_notification settings before outputting them back in the page, allowing high privilege users to set XSS payload on them and leading to stored Cross-Site Scripting issues.

Affected products

• WP YouTube Lyte: before 1.7.16 — fixed in 1.7.16

How to fix

Upgrade to a fixed version: WP YouTube Lyte 1.7.16. Check the vendor advisory for mitigations.

References

• https://m0ze.ru/vulnerability/%5B2021-05-03%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-YouTube-Lyte-WordPress-Plugin-v1.7.15.txt
• https://wpscan.com/vulnerability/0eeff1ee-d11e-4d52-a032-5f5bd8a6a2d7
• https://m0ze.ru/vulnerability/%5B2021-05-03%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-YouTube-Lyte-WordPress-Plugin-v1.7.15.txt
• https://wpscan.com/vulnerability/0eeff1ee-d11e-4d52-a032-5f5bd8a6a2d7

Get alerted when CVE-2021-24419 or the next vulnerability affects your stack