Playlist Player for YouTube

Playlist Player for YouTube has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2023; all 2 are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10. 2023 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

Every one of the 2 issues recorded for Playlist Player for YouTube has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Playlist Player for YouTube is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

5.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Playlist Player for YouTube vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2023-45049

YouTube Playlist Player <= 4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records


2023-10-03 00:00	YouTube Playlist Player <= 4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Playlist Player for YouTube <= 4.6.7	`CVE-2023-45049`	6.4 Medium	yuyudhn	Yes
2023-05-23 00:00	YouTube Playlist Player <= 4.6.4 - Cross-Site Request Forgery in ytpp_settings Playlist Player for YouTube <= 4.6.4	`CVE-2023-33931`	4.3 Medium	Skalucy	Yes

Showing 1–2 of 2 reports

Latestv4.8.2

Playlist Player for YouTube

Author

Ciprian Popescu

4.8(13)

96/100

Last Updated

2026-05-20 (4mo ago)

Active Installs

2,000+

Downloads

72,361

Requires WP

4.9+

Requires PHP

7.0+

Tested up to

WP 7.0.4

Created

2013-11-27 (13y ago)

Display a YouTube player (with an optional playlist) on any post or page using a simple shortcode. The plugin supports a static YouTube player (no video title) and a dynamic one (video title) using the YouTube Data API v3. Embedded players must have a viewport that is at least 200px by 200px. If the player displays controls, it must be large enough to fully display the controls without shrinking the viewport below the minimum size. We recommend 16:9 players be at least 480 pixels wide and 270 pixels tall. The YouTube player is responsive and it will work on all themes and screen sizes! Uses a simple shortcode which can be used in posts, pages, custom post types, widgets, reusable blocks. Uses the default YouTube Embed Code (iframe) with optional privacy-enhanced mode. Uses correct aspect ratio for videos using a Fluid Video technology. Uses native HTML5 Lazy loading. Used modern code and is optimised for speed. 100% free with no ads inside. Static Playlist Player for YouTube Example: [yt_playlist mainid="xcJtL7QggTI" vdid="xcJtL7QggTI, AheYbU8J5Tc, X0zGS4-UKgg, 74SZXCQb44s, 2M0XCH9q3YI, CTNgVQGLy24, B8RpvoHsgI8"] YouTube V3 API Playlist Player Example: [yt_playlist_v3 mainid="xcJtL7QggTI" vdid="xcJtL7QggTI, AheYbU8J5Tc, X0zGS4-UKgg, 74SZXCQb44s, 2M0XCH9q3YI, CTNgVQGLy24, B8RpvoHsgI8"] YouTube Channel Feed with Lightbox Player Example: [yt_feed channels="UCpVm7bg6pXKo1Pr6k5kxG9A" results="9"] Check out the official Playlist Player for YouTube website and a Playlist Player for YouTube demo. Check out a Property Videos & Virtual Tours demo. Check out more WordPress plugins here.

View on WordPress.org