WordPress Plugin Vulnerabilities

All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
all-in-one-video-gallery
Fixed in 5.0.0

References

CVE
CVE-2026-118783

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Elshan Mammadov
Submitter
Elshan Mammadov
Submitter website
https://elshanmammadov.vercel.app/
Verified
Yes
WPVDB ID
119477bd-1b29-4e33-9040-38cb6f0ae623

Timeline

Publicly Published
2026-11-02 (about 2 days ago)
Added
2026-11-02 (about 1 day ago)
Last Updated
2026-11-02 (about 1 day ago)

Other

Published
Title
Published
2024-06-22
Title
Swift Framework < 2024.04.30 - Reflected XSS
Published
2022-09-14
Title
Cryptocurrency Pricing list and Ticker <= 1.5 - Reflected Cross-Site Scripting
Published
2014-08-01
Title
Paramount - Unspecified XSS
Published
2025-05-07
Title
Meks Flexible Shortcodes < 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-02-20
Title
Buttons Shortcode and Widget <= 1.16 - Stored XSS via shortcode