The WP YouTube Live plugin for WordPress contains a Cross‑Site Request Forgery flaw (CWE‑352). This weakness allows an attacker to trick an authenticated user into sending a request that triggers privileged actions within the plugin. The attacker can potentially upload a video, alter playback settings, or otherwise modify content that the affected user is permitted to edit. The impact equals the privileges of the victim user, which could lead to unauthorized content changes or other side effects within the WordPress site.

WordPress installations that run macbookandrew's WP YouTube Live plugin version 1.10.0 or earlier are affected. The vulnerability persists across all releases up to and including 1.10.0 and applies to both public and private deployments of the plugin.

The CVSS score of 4.3 indicates moderate risk, while the EPSS score of less than 1% suggests that exploitation is unlikely at present. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could host a malicious web page that loads a forged request targeting the plugin’s internal endpoints while the victim is authenticated, thereby leveraging the missing CSRF protection.