← back to popular plugins
wordfence / plugin · youtube-embed-plus

Embed Plus for YouTube Gallery, Livestream and Lazy Loading with Facades

youtube-embed-plus
total installs
100,000
total vulns
1
critical
0
high
0
medium
1
low
0
latest vuln
—
patched
1
unpatched
0
avg time to patch
—
vulnerabilities (1)
Youtube Embed Plus <= 14.2.4 - Missing Authorization
medium ✓ patched
cve id CVE-2026-39485 ↗
cvss score 4.3
cwe CWE-862: Missing Authorization
published Mar 6, 2026
The Youtube Embed Plus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 14.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.