4.3
Moyenne
CVE-2025-15516 The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…
Description
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_callback_store_user_meta() function in versions 4.1.0 to 4.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary string-based user meta keys for their own account.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| All-in-One Video Gallery 4.1 | 4.1.0 → 4.6.4 | Pas de correctif indiqué |
Autres CVE de All-in-One Video Gallery
Les 11 CVE de All-in-One Video Gallery →
CVE-2026-12123
The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to,…
6.4
Moyenne
CVE-2026-1706
The All-in-One Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vi' parameter…
6.1
Moyenne
CVE-2025-14947
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…
6.5
Moyenne
CVE-2025-12957
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and…
8.8
Élevée