CVE-2026-3299

OVERVIEW CVE-2026-3299 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WP YouTube Lyte plugin for WordPress in versions up to and including 1.7.29. The vulnerability exists in the plugin's 'lyte' shortcode functionality, where insufficient input sanitization and output escaping of user-supplied attributes allows malicious script injection. SEVERITY The vulnerability carries a CVSS v3.1 score of 6.4 (Medium) and can be exploited over the network with low complexity. Attack exploitation requires authenticated user access at contributor level or above. The impact includes both confidentiality and integrity compromise, as attackers can inject arbitrary web scripts that execute whenever any user accesses an affected page. However, no availability impact is assessed. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog, and community attention remains minimal, as indicated by its inactive status on threat intelligence hot lists. The EPSS score of 0.00011 reflects very low probability of exploitation relative to other CVEs, suggesting this remains primarily a theoretical risk at present.