Lightweight YouTube Channel Widget Security & Risk Analysis

wordpress.org/plugins/lightweight-youtube-channel-widget

Widget showing video thumbnails of recent videos from a YouTube channel or playlist.

10 active installs v10.0 PHP + WP 3.9.0+ Updated Jan 5, 2015
channelfavoritesplaylistwidgetyoutube
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is Lightweight YouTube Channel Widget Safe to Use in 2026?

Generally Safe

Score 85/100

Lightweight YouTube Channel Widget has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 11yr ago
Risk Assessment

The plugin 'lightweight-youtube-channel-widget' v10.0 demonstrates a generally strong security posture based on the static analysis and vulnerability history provided. The absence of known CVEs and a clean vulnerability history suggest good development practices and prompt patching over time. The plugin also shows no dangerous functions, SQL injection vulnerabilities (all queries use prepared statements), file operations, or bundled libraries, which are all positive indicators. However, there are significant concerns regarding output escaping, with only 22% of outputs being properly escaped. This leaves the plugin vulnerable to Cross-Site Scripting (XSS) attacks, where malicious scripts could be injected into the website through the widget's output. Furthermore, the lack of nonce checks and capability checks on the limited entry points (although currently zero in count) is a weakness that could become a risk if new functionalities are added without proper security considerations. While the current attack surface is zero, the low percentage of properly escaped output remains a notable risk.

Key Concerns

  • Low percentage of properly escaped output
  • No nonce checks implemented
  • No capability checks implemented
Vulnerabilities
None known

Lightweight YouTube Channel Widget Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Version History

Lightweight YouTube Channel Widget Release Timeline

v10.0Current
Code Analysis
Analyzed Apr 16, 2026

Lightweight YouTube Channel Widget Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
0 prepared
Unescaped Output
57
16 escaped
Nonce Checks
0
Capability Checks
0
File Operations
0
External Requests
2
Bundled Libraries
0

Output Escaping

22% escaped73 total outputs
Attack Surface

Lightweight YouTube Channel Widget Attack Surface

Entry Points0
Unprotected0
WordPress Hooks 2
actionwidgets_initinc/widget.php:240
actionwp_enqueue_scriptsyoutube-channel.php:41
Maintenance & Trust

Lightweight YouTube Channel Widget Maintenance & Trust

Maintenance Signals

WordPress version tested4.1.42
Last updatedJan 5, 2015
PHP min version
Downloads3K

Community Trust

Rating0/100
Number of ratings0
Active installs10
Developer Profile

Lightweight YouTube Channel Widget Developer Profile

MaTachi

1 plugin · 10 total installs

84
trust score
Avg Security Score
85/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect Lightweight YouTube Channel Widget

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/lightweight-youtube-channel-widget/assets/css/youtube-channel.min.css
Version Parameters
lightweight-youtube-channel-widget/assets/css/youtube-channel.min.css?ver=

HTML / DOM Fingerprints

CSS Classes
youtube_channelytc_video_containerytc_video_
HTML Comments
<!-- .youtube_channel -->
Data Attributes
data-responsive
FAQ

Frequently Asked Questions about Lightweight YouTube Channel Widget