YouTube Showcase vulnerabilities

Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

The Youtube Showcase plugin for WordPress up to version 4.0.4 is vulnerable to Stored Cross-Site Scripting via the 'emd_mb_meta' shortcode. Attachment titles are interpolated into HTML attributes without proper escaping, allowing authenticated attackers with author-level access and above to inject arbitrary scripts.

The Youtube Showcase plugin for WordPress up to version 4.0.3 is vulnerable to arbitrary PHP function call due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler. Authenticated attackers with Subscriber-level access or higher can invoke zero-argument functions like phpinfo or phpversion, leading to information disclosure.

The YouTube Showcase plugin for WordPress is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 3.5.1.