CVE-2026-120408
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored…
- Risk score
- 48/100
- CVSS
- 8.0 v3.1
- Published
- 6 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting atta…
- Affected
- See advisory
- Fix
- Upgrade the product to 5.1.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.0 high
References
Original description
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.
Last activity 6 Nov 2026. Patch Forecast updates every hour.