Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N R U H H H 8.8 .0050 41.0 —
AFFECTED Product Versions Fixed YouTube Embed 10.0 – —
TIMELINE Sep 10 Reserved by WPScan Sep 13 Published (CNA: WPScan) Sep 14 EXPLOIT PUBLISHED — CVE-2026-88793 (Unknown YouTube Embed). Public exploit reference added.
The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.
| Date | Event | Detail |
|---|---|---|
| September 10, 2026 | Reserved | Reserved by WPScan |
| September 13, 2026 | Published | Published (CNA: WPScan) |
| September 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-88793 (Unknown YouTube Embed). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Unknown | YouTube Embed | — | 10.0 | — |
Authoritative record: CVE-2026-88793 at cve.org
Weaknesses: CWE-79
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-88793 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
