Arbitrary File Upload Vulnerability in All-in-One Video Gallery Plugin for WordPress

CVE-2025-12957

What is CVE-2025-12957?

The All-in-One Video Gallery plugin for WordPress is exposed to an arbitrary file upload vulnerability due to inadequate file type validation in all its versions up to and including 4.5.7. This flaw allows authenticated users with author-level access or higher to upload arbitrary files to the server by exploiting a weakness in how VTT files are processed. Malicious actors can use double extension files to bypass security measures, potentially leading to remote code execution on affected sites.

References