The Video Player for YouTube WordPress plugin contains an SQL injection flaw caused by improper sanitisation of user‑supplied input that is incorporated into a database query. Users possessing the Contributor role or higher can supply crafted input, leading to the execution of arbitrary SQL statements and the disclosure of any data stored in the WordPress database.

All WordPress sites running the Video Player for YouTube plugin with a version older than 2.1.0 are affected. The exact vendor is unknown, but the vulnerability applies to every instance of the plugin before the specified release.

The attack vector is a web‑based request to the plugin’s ytp_ajax endpoint, accessible to any authenticated user with the Contributor role or higher. Because the vulnerability allows arbitrary SELECT and potentially other SQL commands, it can lead to information disclosure but does not, in the current description, provide a pathway for code execution. The CVSS score is 6.8, indicating moderate severity, and the EPSS score is <1%; the issue is not listed in CISA’s KEV catalogue, suggesting it is not a widely exploited threat. Nonetheless, the potential for database compromise warrants prompt attention.