Medium severity6.8NVD Advisory· Published Sep 5, 2026· Updated Sep 8, 2026
CVE-2026-84937
CVE-2026-84937
Description
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.1.0
Patches
Vulnerability mechanics
References
1News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)Wordfence Blog · Sep 10, 2026