Threats tagged 'ghsa-jvj2-6jx4-m6x8'

The Video Player for YouTube WordPress plugin versions before 2.1.4 lack a capability check on the player-preset AJAX handler. This flaw allows users with the Contributor role and higher to read the site-wide player-preset configuration. Additionally, in versions before 2.1.1, these users can also modify and delete the player-preset configuration.