Stored Cross-Site Scripting in All-in-One Video Gallery Plugin for WordPress
CVE-2026-109974

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
All-in-one Video Gallery – Video Player & Galleries For Youtube, Vimeo & Self-hosted Videos
Vendor
CVE Published:
28 October 2026

What is CVE-2026-109974?

The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter. This vulnerability arises from inadequate input sanitization and output escaping across all versions up to and including 4.9.7. Authenticated attackers with contributor-level access and above can exploit this flaw to inject arbitrary web scripts into pages, which execute when users visit the compromised pages, potentially leading to unauthorized access and data manipulation.

Affected Version(s)

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos 0 <= 4.9.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/all-in-one-vid...
https://plugins.trac.wordpress.org/browser/all-in-one-vid...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.