Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-84937

YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Video Player For Youtube Project Wordpress
Products
Video Player For Youtube Wordpress
CVE-2021-24414

YT Player < 1.4 - Contributor+ Stored Cross-Site Scripting

The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Video Player For Youtube Project
Products
Video Player For Youtube