The Video Player for YouTube WordPress plugin contains an SQL injection flaw caused by improper sanitisation of user‑supplied input that is incorporated into a database query. Users possessing the Contributor role or higher can supply crafted input, leading to the execution of arbitrary SQL statements and the disclosure of any data stored in the WordPress database.

All WordPress sites running the Video Player for YouTube plugin with a version older than 2.1.0 are affected. The exact vendor is unknown, but the vulnerability applies to every instance of the plugin before the specified release.

The attack vector is a web‑based request to the plugin’s ytp_ajax endpoint, which is accessible to any authenticated user with the Contributor role or higher. Because the vulnerability allows arbitrary SELECT and potentially other SQL commands, it can lead to information disclosure but does not, in the current description, provide a pathway for code execution. No CVSS or EPSS score is specified, and the issue is not listed in CISA’s KEV catalogue, indicating that it is not presently identified as a widely exploited or high‑state threat. Nonetheless, the potential for database compromise warrants prompt attention.