EUVD-2026-71876
GHSA-jcq6-c322-h5qq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Contributor role is PR:L not PR:H; S:C and C:H retained as SQLi reaches cross-table database contents; I:N and A:N as exploitation is read-only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.
AnalysisAI
SQL injection in the Video Player for YouTube WordPress plugin (versions before 2.1.0) allows authenticated users holding the Contributor role or higher to inject arbitrary SQL commands via unsanitized input, enabling them to read any data stored in the underlying WordPress database. The scope change reflected in the CVSS vector (S:C) indicates that exploitation extends reads beyond the plugin's own tables to potentially include WordPress user credentials, secrets, and configuration data held elsewhere in the database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of a valid WordPress Contributor-level account (or any higher role: Author, Editor, Administrator) on the target site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS score of 6.8 uses PR:H (high privileges required), but the description explicitly states exploitation is available to Contributor-level accounts, which is a low-privilege WordPress role. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Video Player for YouTube WordPress plugin to version 2.1.0 or later, which applies proper sanitization and parameterized query handling. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Video Player For Youtube
View allSame weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today