Skip to content
Sign in
6.8 Medium

CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input…

Description

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.

Affected products and versions

Product Affected versions Fixed in
Video Player for YouTube 2.1 earliest → < 2.1.0 2.1.0

Other CVEs of Video Player for YouTube

The 3 CVEs of Video Player for YouTube →
CVE-2026-85007 The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset… 3.8 Low CVE-2021-24414 The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its… Not rated
Track this CVE