WordPress Plugin Vulnerabilities

All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta

Description

The plugin does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.

Proof of Concept

Affects Plugins

Plugin icon
all-in-one-video-gallery
Fixed in 5.1.0

References

CVE
CVE-2026-120408

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.0 (high)

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
ddbbaa38-e9cc-416f-8b3f-72d721f82dc3

Timeline

Publicly Published
2026-11-03 (about 3 days ago)
Added
2026-11-03 (about 2 days ago)
Last Updated
2026-11-05 (about 8 hours ago)

Other

Published
Title
Published
2023-12-05
Title
Calculated Fields Form < 1.2.41 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2026-09-01
Title
Broken Link Checker < 2.4.13.1 - Unauthenticated Stored XSS via Comment Author URL / Link Log
Published
2023-03-17
Title
Ecwid Shopping Cart < 6.11.5 - Contributor+ Stored Cross-Site Scriping
Published
2025-01-06
Title
Gutentor < 3.4.4 - Contributor+ Stored XSS
Published
2025-11-18
Title
Pet-Manager – Petfinder < 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kwm-petfinder Shortcode