Stored Cross-Site Scripting Vulnerability in All-in-One Video Gallery Plugin for WordPress

CVE-2026-109209

What is CVE-2026-109209?

The All-in-One Video Gallery plugin for WordPress is susceptible to a Stored Cross-Site Scripting issue due to inadequate input sanitization on the 'custom_fields[embedcode]' parameter. This vulnerability allows authenticated attackers, with subscriber-level access or higher, to inject and execute arbitrary web scripts in pages viewed by users. This flaw arises from the plugin's save_meta_data() function, which improperly handles requests during XML-RPC operations, coupled with an unconditional capability grant to Subscribers, making exploitation feasible through a simple XML-RPC call.

References