WordPress Plugin Vulnerabilities

Featured Video Plus <= 2.3.3 - Unauthenticated Information Exposure

Description

The Featured Video Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
featured-video-plus
No known fix

References

CVE
CVE-2026-66685
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0213cfce-6dee-4607-bc0f-2001fc208725

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
46abd25f-e674-4aa8-a66a-56b4ce6eb35f

Timeline

Publicly Published
2026-08-06 (about 18 days ago)
Added
2026-08-13 (about 10 days ago)
Last Updated
2026-08-13 (about 10 days ago)

Other

Published
Title
Published
2025-04-01
Title
WP-LESS < 1.9.7 - Unauthenticated Sensitive Information Disclosure
Published
2022-03-30
Title
Be POPIA Compliant < 1.1.6 - Unauthenticated Sensitive Information Exposure
Published
2024-02-07
Title
PPWP – Password Protect Pages < 1.9.0 - Protection Mechanism Bypass
Published
2025-01-17
Title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.9.2 - Information Exposure
Published
2025-05-16
Title
QuickCal < 1.0.16 - Authenticated (Subscriber+) Sensitive Information Exposure