CVE-2026-84937: CWE-89 SQL Injection in Video Player for YouTube

The Video Player for YouTube WordPress plugin versions prior to 2.1.0 contain a SQL injection vulnerability (CWE-89) due to improper sanitization and escaping of user-supplied input in SQL statements. This allows authenticated users with the Contributor role or above to inject SQL commands and read arbitrary database data. The vulnerability has a CVSS 3.1 base score of 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity or availability impact. There is no vendor advisory or patch information available at this time.

An attacker with Contributor or higher privileges can exploit this vulnerability to perform SQL injection attacks, enabling them to read arbitrary data from the database. This compromises the confidentiality of the data stored by the WordPress site using the affected plugin. There is no indication of integrity or availability impact. The vulnerability requires authenticated access with elevated privileges, limiting exploitation scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor and higher roles to trusted users only and monitor for suspicious activity related to database access. Avoid granting Contributor or higher privileges unnecessarily.