What Smash Balloon YouTube Feed does on your site
Smash Balloon YouTube Feed, listed on wordpress.org as Feeds for YouTube, displays the videos of a YouTube channel on your pages: a grid, a list or a gallery with a large player, a header with a "Subscribe" button and a "Load More" button. You build each feed in a visual editor with a live preview, then add it with a block, a widget, an Elementor widget, a Divi module or the [youtube-feed feed=1] shortcode.
To read YouTube data, the plugin needs either your YouTube account, connected with a button, or your own YouTube API key, which is free to create with Google. Videos are cached and refreshed by WordPress's scheduled tasks, every hour by default. The player is only added once a visitor interacts with the feed, and it uses the youtube-nocookie.com domain by default.
The developer, Smash Balloon LLC, also makes Instagram, Facebook, X and TikTok feeds. YouTube Feed Pro, a separate paid plugin, adds playlists, favorites, hand-picked videos, Shorts, the carousel and comments; higher plans add search, turning videos into posts, then live streams and keyword filtering.
Which sites get the most out of a Smash Balloon YouTube feed
The plugin earns its place when your channel publishes regularly and the site has to keep up without manual updates:
- Creators, trainers and coaches: every new video shows up on the home page or a "Videos" page as soon as the cache refreshes.
- Nonprofits and local media: a gallery of the channel with a subscribe button is all the free version needs to do.
- Businesses that publish tutorials: with Pro, a playlist or a selection of videos appears on the matching product page.
It is the wrong pick for a single video (the WordPress Embed block is enough), for videos hosted on your own server, or for showing a playlist, Shorts or a live stream without paying. If you also run an Instagram account, the Smash Balloon Instagram Feed review covers the sister plugin.
Smash Balloon YouTube Feed strengths and limitations
Strengths
- No player on page load. The YouTube iframe only arrives on interaction, and thumbnails, at the smallest useful size, load after the rest of the page.
- Quick to set up. One-button connection, a visual editor with live preview, and placement by block, widget, Elementor or Divi.
- A built-in GDPR mode. The plugin recognizes WPConsent, Complianz, Cookiebot, Borlabs Cookie, Real Cookie Banner and other consent banners.
- Adjustable refresh. Cache updates can be scheduled from every 30 minutes to every 24 hours, independent of visits.
Limitations
- One channel, nothing more, for free. Playlists, favorites, hand-picked videos, Shorts and the carousel require Pro.
- Search and live streams sit in the higher plans. Search starts with the Plus plan, live streams and filtering with Elite.
- Reliance on Google's API. Without a connected account or a valid API key, the feed stops fetching videos.
- Introductory pricing on the first purchase. Renewals are billed at full price: $98 per year for the Basic plan ($49 for the first year only).
- Shortcode vulnerabilities. Two patched XSS flaws let a contributor inject a script through the feed shortcode.
The YouTube Feed settings we recommend
Global settings live under YouTube Feed > Settings, split into the General, Feeds and Advanced tabs; each feed's look is set in YouTube Feed > All Feeds.
| Setting | Recommended value | Why |
|---|---|---|
| Caching (cache update interval) YouTube Feed > Settings > Feeds | Every hour (default), or Every 12 hours if you rarely publish | Fewer requests to the YouTube API, with no visible delay for a quiet channel. |
| GDPR compliance mode YouTube Feed > Settings > Feeds > GDPR | Automatic with a supported banner, otherwise Yes | With Yes, the YouTube Player API is not loaded: thumbnails link to youtube.com instead. |
| Block CDN Images Same screen, shown when GDPR mode is set to Yes | On if no image may come from YouTube | Thumbnails served by YouTube are replaced with a blank placeholder. |
| Preserve settings if plugin is removed YouTube Feed > Settings > General | On during a conflict test or a migration | Otherwise, deleting the plugin also erases your feeds and settings. |
| MCP Write Access YouTube Feed > Settings > General | Off (default) | Lets a connected AI agent (WordPress 6.9 and later) change your feeds. |
| Usage Tracking YouTube Feed > Settings > Advanced | Off (default in the free version) | The weekly report sent to Smash Balloon does nothing for your site. |
| AJAX theme loading fix YouTube Feed > Settings > Advanced | Off, unless your theme loads pages over AJAX | Only useful when the feed fails to appear after navigating without a full reload. |
| Cron Clear Cache YouTube Feed > Settings > Advanced | On only if the feed stops updating | WordPress's scheduled tasks then clear the feed caches at regular intervals. |
- On the General tab, check that the connected account or the API key reports no error.
- Open the feed page in a private window: with GDPR mode on, no YouTube player should load before consent.
- After changing a setting, click "Clear All Caches" on the Feeds tab, then purge your page cache.
Automatic mode only shows videos after consent is given in a recognized banner: WPConsent, which the plugin offers to install, is one of them (see also our article on GDPR and WordPress security).
YouTube Feed security: four medium-severity flaws, all patched
The published vulnerabilities for the plugin are medium severity and all require an account on the site:
- CVE-2026-1631, fixed in 2.6.4: a mere subscriber could delete the license key because of a missing capability check (CVSS 5.4).
- CVE-2025-64635, versions up to 2.4.0: missing authorization, no longer present in version 2.6.1 and later (CVSS 5.3).
- CVE-2024-6256, fixed in 2.2.2: DOM-based stored XSS through the
youtube-feedshortcode attributes, with a contributor account (CVSS 6.4). - CVE-2023-4841, fixed in 2.1.2: stored XSS through the same shortcode, with a contributor account (CVSS 6.4).
The changelog sums up several recent fixes as plain "security hardening", so turn on automatic plugin updates for YouTube Feed. The plugin also stamps every page with a <!-- YouTube Feeds JS --> HTML comment, even pages without a feed (see HTML comments and the generator tag): WP Masquerade Pro removes it and hides the plugin's folder name in file addresses along with the IDs of its CSS and JavaScript files, which makes the plugin harder for bots to spot without replacing the update; the sbyOptions JavaScript variable stays visible.
What WP Masquerade hides for Smash Balloon YouTube Feed
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Smash Balloon YouTube Feed: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- signed HTML comments
- folder name
- tag IDs
Still visible
- JavaScript variables
sbyOptions
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Smash Balloon YouTube Feed FAQ
Do I need a YouTube API key?
Not to get started: connecting your YouTube account with the button is enough. Smash Balloon still recommends an API key, free and created in a few minutes with Google, for better performance and reliability.
Can the free version show a playlist or Shorts?
No, it shows a channel's videos. Playlists, favorites, hand-picked videos and Shorts are in Pro's Basic plan, search in the Plus plan and live streams in the Elite plan.
How much does YouTube Feed Pro cost?
At full price, the pricing page lists $98 per year for one site (Basic), $198 for five sites (Plus), $298 for ten sites (Elite) and $598 for unlimited sites with every Smash Balloon plugin. The first year costs less ($49, $99, $149 and $299); renewals are always at full price.
Why are my new videos not showing up?
The plugin's cache has not refreshed yet, or a page cache is serving an old copy. Click "Clear All Caches" under YouTube Feed > Settings > Feeds, purge the site cache, then turn on "Cron Clear Cache" if the problem comes back.