CVE-2025-14906: CWE-352 Cross-Site Request Forgery (CSRF) in waqasvickey0071 WP Youtube Video Gallery
The WP Youtube Video Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce verification on the wpYTVideoGallerySettingSave() function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AI Analysis
Technical Summary
CVE-2025-14906 is a CSRF vulnerability in the WP Youtube Video Gallery plugin for WordPress, affecting all versions up to and including 1.0. The vulnerability arises because the wpYTVideoGallerySettingSave() function lacks nonce verification, which is a security measure to prevent unauthorized requests. As a result, attackers can craft forged requests that, when executed by an authenticated administrator, modify plugin settings without proper authorization. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and has a network attack vector (AV:N).
Potential Impact
An attacker can cause an authenticated administrator to unknowingly modify the plugin settings via a forged request, potentially altering the behavior or configuration of the WP Youtube Video Gallery plugin. This does not directly lead to confidentiality or availability impact but results in integrity loss of plugin settings.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Administrators should exercise caution and avoid clicking on untrusted links while logged into WordPress with administrative privileges. Monitor the vendor's channels for updates or patches addressing this issue.
CVE-2025-14906: CWE-352 Cross-Site Request Forgery (CSRF) in waqasvickey0071 WP Youtube Video Gallery
Description
The WP Youtube Video Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce verification on the wpYTVideoGallerySettingSave() function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1
Score 4.3medium
Affected software
waqasvickey0071
WP Youtube Video Gallery
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-14906 is a CSRF vulnerability in the WP Youtube Video Gallery plugin for WordPress, affecting all versions up to and including 1.0. The vulnerability arises because the wpYTVideoGallerySettingSave() function lacks nonce verification, which is a security measure to prevent unauthorized requests. As a result, attackers can craft forged requests that, when executed by an authenticated administrator, modify plugin settings without proper authorization. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and has a network attack vector (AV:N).
Potential Impact
An attacker can cause an authenticated administrator to unknowingly modify the plugin settings via a forged request, potentially altering the behavior or configuration of the WP Youtube Video Gallery plugin. This does not directly lead to confidentiality or availability impact but results in integrity loss of plugin settings.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Administrators should exercise caution and avoid clicking on untrusted links while logged into WordPress with administrative privileges. Monitor the vendor's channels for updates or patches addressing this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-12-18T18:08:36.266Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6974765d4623b1157ca738f9
Added to database: 01/24/2026, 07:35:57 UTC
Last enriched: 04/09/2026, 16:54:16 UTC
Last updated: 09/10/2026, 22:19:15 UTC
Views: 132
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.