SZB-4932d23716
EUVD lists unauthenticated XSS in YouTube Showcase up to 4.1.0
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- emarket-design
- Product
- YouTube Showcase
- First seen
Summary
The EUVD listing, shared via a Mastodon post, describes an unauthenticated cross-site scripting flaw in YouTube Showcase versions up to 4.1.0. It is scored 7.1 (CVSS v3.1) and attributed to vendor emarket-design.
If you use emarket-design
Check whether YouTube Showcase is installed and which version is running
Update to a fixed version from the vendor once one is released
If no fix is available, disable the plugin or restrict access to affected pages
What the sources say 1
· Mastodon: “Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.” Source