PT-2026-4573 · WordPress · Wp Youtube Video Gallery

Muhammad Afnaan · Published 2026-01-24 · Updated 2026-01-24 · CVE-2025-14906

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Youtube Video Gallery plugin for WordPress versions prior to 1.1

Description The WP Youtube Video Gallery plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is caused by the absence of nonce verification within the wpYTVideoGallerySettingSave() function. An unauthenticated attacker could potentially modify plugin settings by crafting a malicious request and tricking a site administrator into executing an action, such as clicking a specially designed link.

Recommendations Update the WP Youtube Video Gallery plugin to version 1.1 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-14906

Affected Products

Wp Youtube Video Gallery

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-14906 · Security Note
• https://twitter.com/VulmonFeeds/status/2015021825038655870 · Twitter Post
• https://twitter.com/CVEnew/status/2014995790230675887 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-youtube-video-gallery/tags/1.0/admin/admin.php#L444 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/53709d2c-6522-40f0-9dc4-82517d3ee7b2?source=cve · Note