Unrated severityNVD Advisory· Published Sep 5, 2026
YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax
CVE-2026-84937
Description
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.1.0
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/5f81c233-8544-4a7b-a1c6-e447dc889a8d/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.