plugins360

8 results · Clear filters · Feed

• Medium 6.4
  CVE-2026-116545

  All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field

  The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'custom_fields[].value.label (for key='track')' parameter in all versions up to…

  plugins360 All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos Web / CMS
  Nov 6, 2026
• Medium 6.4
  CVE-2026-109209

  All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC

  The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and including, 4.9.7 due to i…

  plugins360 All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos Web / CMS
  Oct 28, 2026
• Medium 6.4
  CVE-2026-109974

  All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute

  The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient inp…

  plugins360 All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos Web / CMS
  Oct 28, 2026
• Medium 6.4
  CVE-2026-12123

  All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter

  The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to …

  plugins360 All-in-One Video Gallery Web / CMS
  Jul 10, 2026
• Medium 6.1
  CVE-2026-1706

  All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter

  The All-in-One Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vi' parameter in all versions up to, and including, 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthe…

  plugins360 All-in-One Video Gallery Web / CMS
  Mar 4, 2026
• Medium 4.3
  CVE-2025-15516

  All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update

  The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_callback_store_user_meta() function in versions 4.1.0 to 4.6.4. This makes it possible for authenticated attacke…

  plugins360 All-in-One Video Gallery Web / CMS
  Jan 24, 2026
• Medium 6.5
  CVE-2025-14947

  All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion

  The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_create_bunny_stream_video`, `ajax_callback_get_bunny_stream_video`, and `ajax_callback_delete_bunny_st…

  plugins360 All-in-One Video Gallery Web / CMS
  Jan 23, 2026
• Medium 6.4
  CVE-2024-6629

  All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode

  The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping on user supplied attributes.…

  plugins360 All-in-One Video Gallery Web / CMS
  Jul 24, 2024