Skip to content
Sign in
3.8 Low

CVE-2026-85007 The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset…

Description

The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.

Affected products and versions

Product Affected versions Fixed in
Video Player for YouTube 2.1 earliest → < 2.1.4 2.1.4

Other CVEs of Video Player for YouTube

The 3 CVEs of Video Player for YouTube →
CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input… 6.8 Medium CVE-2021-24414 The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its… Not rated
Track this CVE