Wp Youtube Live Vulnerabilities

The WP YouTube Live plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.10.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site admi...

CVSS:

4.3

Affected:

up to 1.10.0

Fixed in:

1.10.1

Disclosed:

Jun 27, 2025

CVE-2025-53261 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in macbookandrew WP YouTube Live allows Cross Site Request Forgery. This issue affects WP YouTube Live: from n/a through 1.10.0.

Affected:

up to 1.10.0

Fix:

No patched version reported

Disclosed:

Jun 27, 2025

CVE-2025-53261 on NVD →

[en] The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected:

up to 1.8.3

Fixed in:

1.8.3

Disclosed:

May 16, 2022

CVE-2022-1334 on NVD →

The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS:

4.8

Affected:

up to 1.8.2

Fixed in:

1.8.3

Disclosed:

Apr 25, 2022

CVE-2022-1334 on NVD →

[en] The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.

Affected:

up to 1.7.22

Fixed in:

1.7.22

Disclosed:

Apr 19, 2022

CVE-2022-1187 on NVD →

The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.

CVSS:

6.1

Affected:

up to 1.7.21

Fixed in:

1.7.22

Disclosed:

Mar 31, 2022

CVE-2022-1187 on NVD →