CVE-2026-85007

LowCVSS 3.8/10Last modified Oct 29, 2026

Description

The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Unknown	Video Player for YouTube	< 2.1.4

References

https://wpscan.com/vulnerability/dd4db01b-8cb9-42d7-8c0b-9afb6e83dc88/

Timeline

Published: Oct 29, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-850085.3undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the confi CVE-2026-850096.5The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied o CVE-2026-85017.8Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the CVE-2026-850105.3The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added CVE-2026-850128.0Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services cod CVE-2026-850137.3A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a loca CVE-2026-850147.5undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSoc CVE-2026-850156.6The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting CVE-2026-850166.8The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attri CVE-2026-850177.5The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes a CVE-2026-85025.3The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposur CVE-2026-850214.3A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/componen