Cross-Site Request Forgery Vulnerability in WP Youtube Video Gallery Plugin
CVE-2025-14906

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
WP Youtube Video Gallery
Vendor
CVE Published:
24 January 2026

What is CVE-2025-14906?

The WP Youtube Video Gallery plugin for WordPress suffers from a Cross-Site Request Forgery vulnerability, allowing unauthenticated attackers to alter plugin settings through misleading requests. This occurs due to insufficient nonce verification in the wpYTVideoGallerySettingSave() function. If an attacker can trick an administrator into clicking a malicious link, they can execute harmful actions on the site, potentially compromising its integrity.

Affected Version(s)

WP Youtube Video Gallery 0 <= 1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-youtube-vid...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Afnaan
.