CVE-2024-10185
Published
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-youtube-embed shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
<p>Embed YouTube content on your WordPress site. Easily embed a YouTube channel, shorts, gallery, feed, or live on your website.</p>
<h3>The most advanced YouTube plugin for WordPress</h3>
<p><span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/QQKCuSG2eHQ?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span></p>
<p>For over 5 years, <a href="https://www.streamweasels.com?utm_source=wordpress&utm_medium=youtube-integration&utm_campaign=readme" rel="nofollow ugc">StreamWeasels</a> have been helping thousands of WordPress websites <strong>embed YouTube channel, YouTube gallery, YouTube feed or YouTube live</strong>.</p>
<p>StreamWeasels YouTube Integration is the latest and greatest plugin from StreamWeasels that <strong>takes YouTube Integration to the next level</strong>.</p>
<p>This plugin allows you to <strong>display YouTube embeds anywhere on your website</strong>, based on YouTube Channel ID, YouTube Playlist or YouTube Live streams.</p>
<h3>Display YouTube Videos by YouTube Channel, Shorts, Playlist, or Live</h3>
<p>StreamWeasels YouTube Integration allows you to display YouTube shorts, YouTube video and YouTube live on your website from youtube.com based on YouTube Channel ID, Playlist or YouTube Live streams.</p>
<ul>
<li>Display upto 50 shorts from a specific YouTube <strong>Channel</strong>.</li>
<li>Display upto 50 videos from a specific YouTube <strong>Channel</strong>.</li>
<li>Display upto 50 videos from a specified YouTube <strong>Playlist</strong>.</li>
<li>Display upto 50 YouTube live streams from a defined YouTube <strong>Channel</strong> list.</li>
</ul>
<h3>Display YouTube Shorts</h3>
<p><iframe loading="lazy" title="Add YouTube shorts to WordPress (for FREE 2022) #shorts" width="750" height="422" src="https://www.youtube.com/embed/3Y1ab3k3ilw?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe></p>
<h3>Layouts</h3>
<p>The best part about StreamWeasels YouTube Integration is our range of layouts. As of our first release, StreamWeasels YouTube Integration allows you to embed YouTube channel content using a YouTube Wall layout. Display your YouTube content as it may appear directly on YouTube. Customise the number of YouTube tiles that display, the number of tiles in a row, the spacing, rounded borders and more.</p>
<h3>Read More</h3>
<p>If you want to learn more about StreamWeasels YouTube Integration, check out these links.</p>
<ul>
<li><a href="https://support.streamweasels.com/article/74-getting-started-with-youtube-integration" rel="nofollow ugc">YouTube Integration – Getting Started Guide</a></li>
<li><a href="https://www.youtube.com/channel/UCo885jUiOeyhtHDFUbdx8rQ" rel="nofollow ugc">Check out our YouTube Guides</a></li>
<li><a href="https://twitter.com/StreamWeasels" rel="nofollow ugc">Follow us on Twitter</a></li>
<li><a href="https://discord.com/invite/HSwfPbm" rel="nofollow ugc">Join us on Discord</a></li>
<li><a href="https://www.streamweasels.com/contact/" rel="nofollow ugc">Need Help? Get in touch!</a></li>
</ul>
WordPress Plugin Directory