CVE-2025-14906

Name of the Vulnerable Software and Affected Versions WP Youtube Video Gallery plugin for WordPress versions prior to 1.1

Description The WP Youtube Video Gallery plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is caused by the absence of nonce verification within the wpYTVideoGallerySettingSave() function. An unauthenticated attacker could potentially modify plugin settings by crafting a malicious request and tricking a site administrator into executing an action, such as clicking a specially designed link.

Recommendations Update the WP Youtube Video Gallery plugin to version 1.1 or later.