WP YouTube Live <= 1.7.21 is vulnerable to Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated

Published
2022-03-30

The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.

CVE

https://www.cve.org/CVERecord?id=CVE-2022-1187

CVSS

Score:5.4

Severity:Medium

Version: 1.7.21

There is a patch available in v1.7.22 and we strongly recommend you update to this version as soon as possible.