Stored DOM-Based Cross-Site Scripting in All-in-One Video Gallery Plugin for WordPress

CVE-2026-116545

What is CVE-2026-116545?

The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'custom_fields[].value.label (for key='track')' parameter. Authenticated users with subscriber-level access can exploit this vulnerability by injecting arbitrary web scripts into pages, which would execute when other users access those pages. This issue is particularly present in configurations that utilize the Plyr/Vidstack player library, with the DOM innerHTML injection vulnerability being restricted to that specific template path.

References