Stored Cross-Site Scripting Vulnerability in All-in-One Video Gallery by WordPress
CVE-2026-118783

Currently unrated

Key Information:

Vendor

WordPress
Status
All-in-one Video Gallery
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-118783?

The All-in-One Video Gallery plugin for WordPress has a vulnerability that allows users with contributor roles and above to exploit unvalidated and unescaped shortcode attributes. When these attributes are output on pages or posts where the shortcode is used, it opens the door for Stored Cross-Site Scripting attacks, potentially compromising website integrity and user data.

Affected Version(s)

All-in-One Video Gallery 0 < 5.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-118783 - Proof of Concept

References

https://wpscan.com/vulnerability/119477bd-1b29-4e33-9040-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Elshan Mammadov
WPScan
.