10 matches found
CVE-2026-84937
CVE-2026-84937 affects the Video Player for YouTube WordPress plugin in versions before 2.1.0 . The plugin fails to properly sanitise and escape user-supplied input before using it in a SQL statement within the ytp_ajax endpoint. Users with the Contributor role or above can exploit this to perfor...
WordPress Video Player for YouTube plugin < 2.1.0 - Contributor+ SQLi vulnerability
Contributor+ SQLi vulnerability discovered by Artus KG in WordPress Plugin YT Player versions 2.1.0...
CVE-2025-13849
The Cool YT Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
CVE-2025-13849
The Cool YT Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
CVE-2025-13849 Cool YT Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The Cool YT Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
CVE-2025-13849
CVE-2025-13849 — Cool YT Player for WordPress : A stored XSS flaw exists in the Cool YT Player plugin for WordPress via the videoid parameter for versions up to 1.0. The vulnerability enables an authenticated attacker with Contributor+ privileges to inject script that executes when users view the...
CVE-2025-13849 Cool YT Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The Cool YT Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
PT-2026-1610
Name of the Vulnerable Software and Affected Versions The Cool YT Player plugin for WordPress versions prior to 1.1 Description The Cool YT Player plugin for WordPress is susceptible to Stored Cross-Site Scripting through the videoid parameter. Insufficient input sanitization and output escaping...
WordPress Cool YT Player plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Gilang - DJ in WordPress Plugin Cool YT Player versions = 1.0...
