{ "title": "Smash Balloon YouTube Feed", "seo_title": "Smash Balloon YouTube Feed: review, settings and limits", "h1": "Smash Balloon YouTube Feed", "description": "Smash Balloon YouTube Feed free or Pro: strengths, limitations, pricing, API key or connected account, GDPR and cache settings, patched vulnerabilities.", "lead": "Smash Balloon YouTube Feed displays your YouTube channel's videos in WordPress as a grid, list or gallery, with caching and a player that loads on demand. Our take on the free version versus Pro, the GDPR and cache settings to pick and the patched vulnerabilities.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-youtube-feed/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-youtube-feed/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-youtube-feed/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-youtube-feed/index.json", "published": "2026-11-05T08:00:00+00:00", "modified": "2026-11-05T21:35:22+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "Smash Balloon YouTube Feed", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-youtube-feed/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-youtube-feed/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-youtube-feed/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Smash Balloon YouTube Feed", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/smash-balloon-youtube-feed/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/smash-balloon-youtube-feed/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/smash-balloon-youtube-feed/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Smash Balloon YouTube Feed", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/smash-balloon-youtube-feed/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/smash-balloon-youtube-feed/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/smash-balloon-youtube-feed/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "Smash Balloon YouTube Feed", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/smash-balloon-youtube-feed/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/smash-balloon-youtube-feed/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/smash-balloon-youtube-feed/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "Smash Balloon YouTube Feed", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/smash-balloon-youtube-feed/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/smash-balloon-youtube-feed/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/smash-balloon-youtube-feed/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Smash Balloon YouTube Feed", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/smash-balloon-youtube-feed/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/smash-balloon-youtube-feed/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/smash-balloon-youtube-feed/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "Smash Balloon YouTube Feed", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/smash-balloon-youtube-feed/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/smash-balloon-youtube-feed/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/smash-balloon-youtube-feed/index.json" } ], "headings": [ { "level": 1, "text": "Smash Balloon YouTube Feed" }, { "level": 2, "text": "What Smash Balloon YouTube Feed does on your site" }, { "level": 2, "text": "Which sites get the most out of a Smash Balloon YouTube feed" }, { "level": 2, "text": "Smash Balloon YouTube Feed strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The YouTube Feed settings we recommend" }, { "level": 2, "text": "YouTube Feed security: four medium-severity flaws, all patched" }, { "level": 2, "text": "Smash Balloon YouTube Feed FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for creators and nonprofits that want their YouTube channel on their site with no manual updates.\n- Main caveat: the free version only shows a channel; playlists, Shorts, search and live streams cost extra.\n- Free; Pro costs $98 per year for one site ($49 the first year).\n\n## What Smash Balloon YouTube Feed does on your site\n\nSmash Balloon YouTube Feed, listed on wordpress.org as Feeds for YouTube, displays the videos of a YouTube channel on your pages: a grid, a list or a gallery with a large player, a header with a \"Subscribe\" button and a \"Load More\" button. You build each feed in a visual editor with a live preview, then add it with a block, a widget, an Elementor widget, a Divi module or the `[youtube-feed feed=1]` shortcode.\n\nTo read YouTube data, the plugin needs either your YouTube account, connected with a button, or your own YouTube API key, which is free to create with Google. Videos are cached and refreshed by WordPress's scheduled tasks, every hour by default. The player is only added once a visitor interacts with the feed, and it uses the `youtube-nocookie.com` domain by default.\n\nThe developer, Smash Balloon LLC, also makes Instagram, Facebook, X and TikTok feeds. YouTube Feed Pro, a separate paid plugin, adds playlists, favorites, hand-picked videos, Shorts, the carousel and comments; higher plans add search, turning videos into posts, then live streams and keyword filtering.\n\n![Diagram: Smash Balloon YouTube Feed works on visitors and bots, wordpress, external services. Public traces: signed HTML comments (hidden with Pro); folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/youtube-feed/diagram-en.svg?v=cbe01a87)\n\n## Which sites get the most out of a Smash Balloon YouTube feed\n\nThe plugin earns its place when your channel publishes regularly and the site has to keep up without manual updates:\n\n- **Creators, trainers and coaches**: every new video shows up on the home page or a \"Videos\" page as soon as the cache refreshes.\n- **Nonprofits and local media**: a gallery of the channel with a subscribe button is all the free version needs to do.\n- **Businesses that publish tutorials**: with Pro, a playlist or a selection of videos appears on the matching product page.\n\nIt is the wrong pick for a single video (the WordPress Embed block is enough), for videos hosted on your own server, or for showing a playlist, Shorts or a live stream without paying. If you also run an Instagram account, the [Smash Balloon Instagram Feed](https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-instagram-feed/) review covers the sister plugin.\n\n## Smash Balloon YouTube Feed strengths and limitations\n\n### Strengths\n\n- **No player on page load.** The YouTube iframe only arrives on interaction, and thumbnails, at the smallest useful size, load after the rest of the page.\n- **Quick to set up.** One-button connection, a visual editor with live preview, and placement by block, widget, Elementor or Divi.\n- **A built-in GDPR mode.** The plugin recognizes WPConsent, Complianz, Cookiebot, Borlabs Cookie, Real Cookie Banner and other consent banners.\n- **Adjustable refresh.** Cache updates can be scheduled from every 30 minutes to every 24 hours, independent of visits.\n\n### Limitations\n\n- **One channel, nothing more, for free.** Playlists, favorites, hand-picked videos, Shorts and the carousel require Pro.\n- **Search and live streams sit in the higher plans.** Search starts with the Plus plan, live streams and filtering with Elite.\n- **Reliance on Google's API.** Without a connected account or a valid API key, the feed stops fetching videos.\n- **Introductory pricing on the first purchase.** Renewals are billed at full price: $98 per year for the Basic plan ($49 for the first year only).\n- **Shortcode vulnerabilities.** Two patched XSS flaws let a contributor inject a script through the feed shortcode.\n\n## The YouTube Feed settings we recommend\n\nGlobal settings live under YouTube Feed > Settings, split into the General, Feeds and Advanced tabs; each feed's look is set in YouTube Feed > All Feeds.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Caching** (cache update interval) YouTube Feed > Settings > Feeds | Every hour (default), or Every 12 hours if you rarely publish | Fewer requests to the YouTube API, with no visible delay for a quiet channel. |\n| **GDPR compliance mode** YouTube Feed > Settings > Feeds > GDPR | Automatic with a supported banner, otherwise Yes | With Yes, the YouTube Player API is not loaded: thumbnails link to youtube.com instead. |\n| **Block CDN Images** Same screen, shown when GDPR mode is set to Yes | On if no image may come from YouTube | Thumbnails served by YouTube are replaced with a blank placeholder. |\n| **Preserve settings if plugin is removed** YouTube Feed > Settings > General | On during a conflict test or a migration | Otherwise, deleting the plugin also erases your feeds and settings. |\n| **MCP Write Access** YouTube Feed > Settings > General | Off (default) | Lets a connected AI agent (WordPress 6.9 and later) change your feeds. |\n| **Usage Tracking** YouTube Feed > Settings > Advanced | Off (default in the free version) | The weekly report sent to Smash Balloon does nothing for your site. |\n| **AJAX theme loading fix** YouTube Feed > Settings > Advanced | Off, unless your theme loads pages over AJAX | Only useful when the feed fails to appear after navigating without a full reload. |\n| **Cron Clear Cache** YouTube Feed > Settings > Advanced | On only if the feed stops updating | WordPress's scheduled tasks then clear the feed caches at regular intervals. |\n\n- On the General tab, check that the connected account or the API key reports no error.\n- Open the feed page in a private window: with GDPR mode on, no YouTube player should load before consent.\n- After changing a setting, click \"Clear All Caches\" on the Feeds tab, then purge your page cache.\n\nAutomatic mode only shows videos after consent is given in a recognized banner: [WPConsent](https://www.wp-masquerade.com/features/camouflaged-plugins/wpconsent/), which the plugin offers to install, is one of them (see also our article on GDPR and WordPress security).\n\n## YouTube Feed security: four medium-severity flaws, all patched\n\nThe published vulnerabilities for the plugin are medium severity and all require an account on the site:\n\n- **CVE-2026-1631, fixed in 2.6.4**: a mere subscriber could delete the license key because of a missing capability check (CVSS 5.4).\n- **CVE-2025-64635, versions up to 2.4.0**: missing authorization, no longer present in version 2.6.1 and later (CVSS 5.3).\n- **CVE-2024-6256, fixed in 2.2.2**: DOM-based stored [XSS](https://www.wp-masquerade.com/glossary/xss/) through the `youtube-feed` shortcode attributes, with a contributor account (CVSS 6.4).\n- **CVE-2023-4841, fixed in 2.1.2**: stored XSS through the same shortcode, with a contributor account (CVSS 6.4).\n\nThe changelog sums up several recent fixes as plain \"security hardening\", so turn on automatic plugin updates for YouTube Feed. The plugin also stamps every page with a `` HTML comment, even pages without a feed (see [HTML comments and the generator tag](https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/)): WP Masquerade Pro removes it and hides the plugin's folder name in file addresses along with the IDs of its CSS and JavaScript files, which makes the plugin harder for bots to spot without replacing the update; the `sbyOptions` JavaScript variable stays visible.\n\n## Smash Balloon YouTube Feed FAQ\n\n**Do I need a YouTube API key?**\n\nNot to get started: connecting your YouTube account with the button is enough. Smash Balloon still recommends an API key, free and created in a few minutes with Google, for better performance and reliability.\n\n**Can the free version show a playlist or Shorts?**\n\nNo, it shows a channel's videos. Playlists, favorites, hand-picked videos and Shorts are in Pro's Basic plan, search in the Plus plan and live streams in the Elite plan.\n\n**How much does YouTube Feed Pro cost?**\n\nAt full price, the pricing page lists $98 per year for one site (Basic), $198 for five sites (Plus), $298 for ten sites (Elite) and $598 for unlimited sites with every Smash Balloon plugin. The first year costs less ($49, $99, $149 and $299); renewals are always at full price.\n\n**Why are my new videos not showing up?**\n\nThe plugin's cache has not refreshed yet, or a page cache is serving an old copy. Click \"Clear All Caches\" under YouTube Feed > Settings > Feeds, purge the site cache, then turn on \"Cron Clear Cache\" if the problem comes back.\n\n## Key facts\n\n- Category: Newsletter, pop-ups and sharing\n- Vendor: Smash Balloon LLC\n- Price: Free; Pro from $98 per year for one site ($49 for the first year)\n- Active installations (wordpress.org): 100 000+\n- Version: 2.11.1\n- Official page: https://wordpress.org/plugins/feeds-for-youtube/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: signed HTML comments, folder name, tag IDs\n- Still visible: JavaScript variables", "catalog": "youtube-feed", "essentials": [ "Best for creators and nonprofits that want their YouTube channel on their site with no manual updates.", "Main caveat: the free version only shows a channel; playlists, Shorts, search and live streams cost extra.", "Free; Pro costs $98 per year for one site ($49 the first year)." ], "format": "application/json" }