6.8
Medium
CVE-2026-118783 All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute
Description
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HExploitable remotely over the network, with an administrator account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| All-in-One Video Gallery 5.0 | earliest → < 5.0.0 | 5.0.0 |
Other CVEs of All-in-One Video Gallery
The 6 CVEs of All-in-One Video Gallery →
CVE-2026-119259
All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write
5.3
Medium
CVE-2026-120408
All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta
8.0
High
CVE-2026-118629
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering…
5.3
Medium
CVE-2026-19075
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=` on any…
5.0
Medium