CVE-2026-114693
MediumCVSS 6.5Summary
The WordPress plugin 'All-in-One Video Gallery' (versions up to 4.9.7) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. A malicious script stored in the database executes for users visiting the site.
Risk Assessment
Stored XSS can lead to user and admin account takeover, session data theft, and persistent site compromise. The risk is high because the script is stored and executed repeatedly.
Recommendation
Update the 'All-in-One Video Gallery' plugin to a version later than 4.9.7 or remove it. Inspect and clean the database for potentially injected scripts.
Other vulnerabilities in All-in-One Video Gallery
See all- CVE-2026-19075Medium
The All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post. It reads the post's `mp4` meta value and streams that URL's response back to the requester.
- CVE-2026-12123Medium
The All-in-One Video Gallery plugin for WordPress up to version 4.8.5 is vulnerable to Server-Side Request Forgery (SSRF) via the 'vdl' parameter. An authenticated attacker with subscriber-level access can make arbitrary web requests from the server, including to internal services, and read their responses.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 4.9.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS