Playlist Player for YouTube – Fast, Privacy-Friendly Playlists & Channel Feed
Playlist Player for YouTube – Fast, Privacy-Friendly Playlists & Channel Feed has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2023; all 2 are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10. 2023 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.
Every one of the 2 issues recorded for Playlist Player for YouTube – Fast, Privacy-Friendly Playlists & Channel Feed has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Playlist Player for YouTube – Fast, Privacy-Friendly Playlists & Channel Feed is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.
CVE-2023-45049YouTube Playlist Player <= 4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Playlist Player for YouTube – Fast, Privacy-Friendly Playlists & Channel Feed
Author
Ciprian Popescu
Show a YouTube player with a playlist, or the latest videos from your channel, on any post or page with one shortcode. Videos are click-to-load: visitors see a lightweight thumbnail, and nothing is requested from YouTube until they press play. That keeps pages fast and makes it easier to respect cookie consent. Click-to-load players for faster pages and better privacy, with an optional notice under the player. Paste full YouTube URLs or video IDs. Add ?t=90 to a URL to start that video at 90 seconds. Three layouts: playlist below the player, beside it, or a grid that opens videos in an accessible lightbox. Auto-advance to the next video, several players on the same page, and keyboard-friendly playlists. Your YouTube API key stays on the server. Video titles and channel feeds are fetched and cached by WordPress. Optional VideoObject structured data for search engines. Privacy-enhanced (youtube-nocookie.com) mode. A shortcode generator in Settings, so you don’t need to remember any attributes. Playlist (no API key needed) Example: [yt_playlist mainid="xcJtL7QggTI" vdid="xcJtL7QggTI, AheYbU8J5Tc, X0zGS4-UKgg, 74SZXCQb44s, 2M0XCH9q3YI"] Playlist with video titles (YouTube Data API v3) Example: [yt_playlist_v3 mainid="xcJtL7QggTI" vdid="xcJtL7QggTI, AheYbU8J5Tc, X0zGS4-UKgg" layout="side" autoadvance="1"] YouTube channel feed with lightbox player Example: [yt_feed channels="UCpVm7bg6pXKo1Pr6k5kxG9A" results="9" offset="0"] Optional attributes layout="below|side|grid" start="90" (main video start time in seconds) autoadvance="1" schema="1" (VideoObject structured data, needs the API key) offset="3" (channel feed only) Check out the official Playlist Player for YouTube website and a Playlist Player for YouTube demo. Check out a Property Videos & Virtual Tours demo. Check out more WordPress plugins here. Need cookie consent for YouTube? Try WP Google Consent Platform (GCP). From the same author Active Contacts – WordPress CRM & Follow-up Plugin LazyClone – Copy a WordPress Site Without FTP Lighthouse – WordPress Performance & Speed Optimization Plugin Active Analytics – Privacy-Friendly WordPress Analytics Plugin ImagePress – WordPress Image Gallery & Community Photo Plugin eCards – WordPress eCard Plugin with Email Designer Repeater for Gravity Forms – Repeater Field Add-on Fixtures & Results – WordPress Sports League & GAA Club Plugin WP Google Consent Platform (GCP)
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C