CVE-2026-84937

YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.

Affected

Video Player for YouTube

CVSS v3.1 CNA

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

EPSS

0.39% chance of exploitation in the next 30 days, 32nd percentile

Published

2026-09-05

Updated

2026-09-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/5f81c233-8544-4a7b-a1c6-e447dc889a8d/

References

• CVE Record
• NVD entry