CVE-2025-53261

The WP YouTube Live plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 1.10.0 [1]. The vulnerability exists due to missing or insufficient nonce validation, allowing an attacker to craft malicious requests that can be executed by a privileged user.

Exploitation requires user interaction, such as a logged-in administrator clicking a malicious link or visiting a crafted page [1]. This can be leveraged in mass-exploit campaigns targeting thousands of sites without needing authentication.

A successful CSRF attack could force the victim to perform unintended actions under their current session, such as modifying plugin settings or executing administrative tasks [1]. This could lead to site compromise or further exploitation.

The vulnerability is resolved in version 1.10.1. Users are strongly advised to update immediately [1]. No other workarounds are provided.