Youtube Playlist Player Vulnerabilities

[en] Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.7 versions.

Affected:

up to 4.6.8

Fixed in:

4.6.8

Disclosed:

Oct 18, 2023

CVE-2023-45049 on NVD →

The YouTube Playlist Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts i...

CVSS:

6.4

Affected:

up to 4.6.7

Fixed in:

4.6.8

Disclosed:

Oct 3, 2023

CVE-2023-45049 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.4 versions.

Affected:

up to 4.6.5

Fixed in:

4.6.5

Disclosed:

May 28, 2023

CVE-2023-33931 on NVD →

The YouTube Playlist Player plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.6.4. This is due to missing or incorrect nonce validation on the ytpp_settings function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request gr...

CVSS:

4.3

Affected:

up to 4.6.4

Fixed in:

4.6.5

Disclosed:

May 23, 2023

CVE-2023-33931 on NVD →