Youtube Channel Vulnerabilities

The My YouTube Channel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.23.3. This is due to missing or incorrect nonce validation on the clear_all_cache function. This makes it possible for unauthenticated attackers to clear the plugin's cache via a forged request gr...

CVSS:

4.3

Affected:

up to 3.23.3

Fixed in:

3.23.4

Disclosed:

Feb 23, 2023

CVE-2023-25987 on NVD →

The YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level a...

CVSS:

6.4

Affected:

up to 3.0.12.1

Fixed in:

3.23.0

Disclosed:

Jan 11, 2023

CVE-2022-4756 on NVD →

The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above,...

CVSS:

5.5

Affected:

up to 3.0.12.1

Fixed in:

3.23.0

Disclosed:

Jan 4, 2023

CVE-2023-0446 on NVD →

The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache function in versions up to, and including, 3.0.12.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to clear the plugin's cache.

CVSS:

4.3

Affected:

up to 3.0.12.1

Fixed in:

3.23.0

Disclosed:

Jan 4, 2023

CVE-2023-0447 on NVD →