Skip to content
Sign in
Not rated

CVE-2021-24414 The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its…

Description

The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode

Affected products and versions

Product Affected versions Fixed in
Video Player for YouTube 1.4 earliest → < 1.4 1.4

Other CVEs of Video Player for YouTube

The 3 CVEs of Video Player for YouTube →
CVE-2026-85007 The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset… 3.8 Low CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input… 6.8 Medium
Track this CVE