8.8
High
CVE-2025-12966 The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type…
Description
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the resolve_import_directory() function in versions 4.5.4 to 4.5.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| All-in-One Video Gallery 4.5 | 4.5.4 → 4.5.7 | No fix stated |
Other CVEs of All-in-One Video Gallery
The 11 CVEs of All-in-One Video Gallery →
CVE-2026-12123
The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to,…
6.4
Medium
CVE-2026-1706
The All-in-One Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vi' parameter…
6.1
Medium
CVE-2025-15516
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…
4.3
Medium
CVE-2025-14947
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…
6.5
Medium