YouTube Embed, Playlist and Popup by WpDevArt

YouTube Embed, Playlist and Popup by WpDevArt has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2025; 2 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 5.7, and the most serious one scores 6.4 out of 10.

The most common weakness is Improper Neutralization Of Input During Web Page Generation, behind 3 of the records (100%).

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

3 independent researchers contributed these findings, one record each.

01234567891028.06.2021Today28.06.20216.4YouTube Embed, Playlist and Popup <= 2.3.8 - Contributor+ Stored Cross-Site Scripting CVSS 6.4 · 28.06.202123.01.20234.4YouTube Embed <= 2.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 23.01.202303.07.20256.4Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library CVSS 6.4 · 03.07.2025

Strategic Overview

Avg CVSSMedium
5.7/ 10
Patch Coverage67%
Open

1

Fixed

2

Get automatic notifications for all YouTube Embed, Playlist and Popup by WpDevArt vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-2537

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library

Read the full analysis

Vulnerability Records

3 records
Showing 1–3 of 3 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C