basic page error

I notice your YouTube embedding code looks like:

<iframe allowfullscreen="" frameborder="0" height="236" sandbox="" src="https://www.youtube.com/embed/xxxxxxxxxxx?rel=0&amp;fs=0" width="420"></iframe>

Having run a quick test, it looks like the video will show up in the page if you remove the sandbox="" attribute.

(Also, your second YouTube embed src attribute has a space immediately after the opening double-quote. I don't think this is actually causing a problem but it shouldn't really be there.)

I'll keep my fingers crossed that removing the sandbox="" attributes resolves your problem.

Just in case this does not work (although it does work in my own test), here is the current YouTube embed code (taken from a video on the YouTube site a couple of minutes ago). You could try using the same format and attributes as this:

<iframe width="560" height="315" src="https://www.youtube.com/embed/xxxxxxxxxxx?si=xxxxxxxxxxxxxxxx" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>

(I think the ?si=xxxxxxxxxxxxxxxx query string is a tracking id which can probably be omitted.)

I'm glad that helped.

That's weird. I've just searched through every Showkase source file and the term 'sandbox' was not found.

Also, during my original test, I did not manually remove the 'sandbox' attribute from the HTML file in an external text editor, I used the built-in Showkase page editor and saved the page normally and the 'sandbox' attribute did not reappear (even after a re-save with no 'sandbox' attribute there).

The editor puts the attributes in alphabetical order and changes sandbox to sandbox="" (similar for all attributes without a value) but does not seem to actually add 'sandbox' if it's not already there... at least in my own tests.

Thank you for the additional information. I think that might be the root of the problem.
My tests were done on a stock Showkase v1.7.6 installation (without the patch in place).
My patch updates CKEditor (the Showkase editor) and I've done some digging and found the following in the CKEditor changelog:

That's all well and good, in theory, but, as we've discovered, this prevents Vimeo and YouTube videos from displaying.
Here's something to try. Open the showkase/admin/settings/ckeditorconfig.js file (from your patched installation) and add the following to the foot of the file (before the closing };).

config.iframe_attributes = {
    sandbox: 'allow-scripts allow-same-origin'
}

This should add the sandbox="allow-scripts allow-same-origin" attribute to your iframes (instead of sandbox="") allowing your videos to display.
Hopefully this'll fix the problem.

Code and code placement looks fine. it worked for me when I tested it (before posting).
Maybe some caching (client-side or server-side) is still serving up the older version of your file (before modification)? Try going directly to your showkase/admin/settings/ckeditorconfig.js file in a browser, hit Ctrl+F5, make sure that you see the new code at the bottom of the file and then try again. I'll keep my fingers crossed.

I don't think you're missing anything. If you are missing something, I'm missing it, too.

I've just used your modified ckeditorconfig.js file in my test site (Showkase-Pro v1.7.6 with latest patch) and the attribute is added to the <iframe> code each time the site is published (and my test YouTube video is displayed in the site).

The one thing I find to be odd is when you say "When I go back to Showkase, remove the sandbox references and re-publish, it does show correctly.".
With the new code in place (at the foot of the ckeditorconfig.js file), each time you publish the site, the editor will add the sandbox="allow-scripts allow-same-origin" attribute to all iframes.

• If an iframe has no sandbox attribute, publishing should ensure that it has the sandbox="allow-scripts allow-same-origin" attribute.

• If an iframe has a pre-existing sandbox attribute with any value (even empty ""), publishing should ensure that the sandbox attribute changes to "allow-scripts allow-same-origin".

Therefore, every time you publish, (even after removing the sandbox attributes), each and every iframe should have the sandbox="allow-scripts allow-same-origin" attribute and the videos should display.
This seems to be working as expected in my test site.

If I can think of anything that might be causing this process to not work in your own site, I'll be sure to post back.

Edit:
If you are able to remove the sandbox attributes by removing them in the editor and republishing (and they don't reappear with the "allow-scripts allow-same-origin" value), then your editor does not seem to working in the same way that mine does.
Maybe try re-applying the patch to make sure your site is using exactly the same files as mine. (Link in this post.) I've updated the patch a couple of times since it was first released and the latest version includes the new sandbox attribute (in the ckeditorconfig.js file) so, after applying the patch, there are no files to manually edit/update.

Essentially, yes.
The patch has a few files outside the admin folder but everything relating to CKEditor is inside the admin folder (and if you have already applied any version of the patch, you'll already have up-to-date versions of everything outside the admin folder).

Applying the patch (see here for details) will not affect the log-in credentials or any pre-existing pages or settings.
Bear in mind that if you previously modified any Showkase source files that are included in the patch, then your modifications will be lost and you'll need to reinstate them (in the new files from the patch).
However, if you have not modified any Showkase source files and have just used the Showkase admin to create and manage your site, then applying the patch will not change any of your personal pages or settings.

I'll keep my fingers crossed that applying the patch will resolve your problem. (The new patched files certainly seem to work OK for me with regard to embedding YouTube videos in iframes. I just double-checked with a new site a couple of minutes ago.)