# Really Simple Featured Video <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title in CIX Gallery Template

- **ID:** WPSEC-2026-2406
- **Plugin:** Really Simple Featured Video for Posts, Pages & WooCommerce Products (`really-simple-featured-video`), https://wordpress.org/plugins/really-simple-featured-video/
- **Affected versions:** from 0.15.0 before 1.2.0
- **Fixed in:** 1.2.0 (Update to 1.2.0 or later.)
- **Severity:** Medium 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/really-simple-featured-video
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2406/

## Description

The Really Simple Featured Video for Posts, Pages & WooCommerce Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment titles in the CIX Woo Gallery Slider product gallery template in versions from 0.15.0 up to, and including, 1.1.0. This is due to attachment titles being placed unencoded into the lightbox data-caption attribute, which the lightbox renders as HTML. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts that execute when a user opens the lightbox on a product page, provided the CIX integration is active and the attacker's media is used in the product gallery.

## References

- https://wpsec.com/vuln/WPSEC-2026-2406/
- https://plugins.svn.wordpress.org/really-simple-featured-video/tags/1.2.0/
- https://wordpress.org/plugins/really-simple-featured-video/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2406/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.