CVE-2026-84937 YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

CVE-2026-84937 YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

CVE-2026-84937

The Video Player for YouTube WordPress plugin, in versions before 2.1.0 , is vulnerable to a SQL injection attack. The root cause is the improper sanitization and escaping of user-supplied input before it is processed in a SQL statement. This flaw allows users with the Contributor role or higher ...