8.0
High
CVE-2026-120408 All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta
Description
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HExploitable remotely over the network, with an ordinary account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| All-in-One Video Gallery 5.1 | earliest → < 5.1.0 | 5.1.0 |
Other CVEs of All-in-One Video Gallery
The 6 CVEs of All-in-One Video Gallery →
CVE-2026-119259
All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write
5.3
Medium
CVE-2026-118783
All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute
6.8
Medium
CVE-2026-118629
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering…
5.3
Medium
CVE-2026-19075
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=` on any…
5.0
Medium