CVE-2025-7966
Description
The Get Youtube Subs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘channel', 'layout', and 'subs_count’ parameters in all versions up to, and including, 3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Stored XSS in Get Youtube Subs plugin (≤3.5) allows authenticated contributors to inject arbitrary scripts via channel, layout, or subs_count parameters.
The Get Youtube Subs plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.5. The vulnerability stems from insufficient input sanitization and output escaping on the 'channel', 'layout', and 'subs_count' parameters, allowing attackers to inject arbitrary HTML and JavaScript [1].
Exploitation requires an authenticated attacker with at least Contributor-level access. The attacker can inject malicious scripts via the plugin's settings or widget configuration, and the payload will execute whenever a user accesses the affected page [1].
Successful exploitation enables arbitrary web script execution in the context of the victim's browser, potentially leading to session hijacking, data theft, or website defacement [1].
As of July 22, 2025, the plugin has been closed on WordPress.org due to this security issue, and no patched version is available [1]. Users are advised to remove the plugin from their installations.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=3.5
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3News mentions
0No linked articles in our index yet.