Medium severity6.1NVD Advisory· Published Apr 19, 2022· Updated Apr 8, 2026

CVE-2022-1187

Description

The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.

Affected products

Andrewrminion/Wp Youtube Live
cpe:2.3:a:andrewrminion:wp_youtube_live:*:*:*:*:*:wordpress:*:*
Range: <1.7.22

Patches

587d832ec17c

https://github.com/macbookandrew/wp-youtube-livevia osv

2d8ccb7b1274

https://github.com/macbookandrew/wp-youtube-livevia nvd-ref

commit

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/macbookandrew/wp-youtube-live/commit/2d8ccb7b12742bf16b5a6068f9fdeeac69bc11b1nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/2d540b53-5c39-43d5-a055-cc5eccfa65b8nvdThird Party Advisory
plugins.trac.wordpress.org/browser/wp-youtube-live/trunk/inc/admin.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000