{
 "id": "WPSEC-2026-2406",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2406/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2406/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2406/index.md",
 "title": "Really Simple Featured Video <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title in CIX Gallery Template",
 "description": "The Really Simple Featured Video for Posts, Pages & WooCommerce Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment titles in the CIX Woo Gallery Slider product gallery template in versions from 0.15.0 up to, and including, 1.1.0. This is due to attachment titles being placed unencoded into the lightbox data-caption attribute, which the lightbox renders as HTML. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts that execute when a user opens the lightbox on a product page, provided the CIX integration is active and the attacker's media is used in the product gallery.",
 "plugin": {
  "slug": "really-simple-featured-video",
  "name": "Really Simple Featured Video",
  "full_name": "Really Simple Featured Video for Posts, Pages & WooCommerce Products",
  "wordpress_org": "https://wordpress.org/plugins/really-simple-featured-video/",
  "advisories_url": "https://wpsec.com/vuln/plugin/really-simple-featured-video/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/really-simple-featured-video"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "0.15.0",
    "from_inclusive": true,
    "to": "1.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 0.15.0 before 1.2.0"
  ]
 },
 "introduced_in": "0.15.0",
 "fixed_in": "1.2.0",
 "remediation": "Update to 1.2.0 or later.",
 "fix_released": "2026-11-02T15:30:51+00:00",
 "published": "2026-11-03T15:50:58+00:00",
 "updated": "2026-11-03T13:40:24.329041+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2406/",
  "https://plugins.svn.wordpress.org/really-simple-featured-video/tags/1.2.0/",
  "https://wordpress.org/plugins/really-simple-featured-video/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/really-simple-featured-video",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}