Medium severity6.1NVD Advisory· Published Apr 19, 2022· Updated Apr 8, 2026

CVE-2022-1187

Description

The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Andrewrminion/Wp Youtube Live
cpe:2.3:a:andrewrminion:wp_youtube_live:*:*:*:*:*:wordpress:*:*
Range: <1.7.22
WordPress/Wp Youtube Livellm-fuzzy
Range: <=1.7.21
Package: https://wordpress.org/plugins/wp-youtube-live

Patches

Vulnerability mechanics

References

github.com/macbookandrew/wp-youtube-live/commit/2d8ccb7b12742bf16b5a6068f9fdeeac69bc11b1nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/2d540b53-5c39-43d5-a055-cc5eccfa65b8nvdThird Party Advisory
plugins.trac.wordpress.org/browser/wp-youtube-live/trunk/inc/admin.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000