CVE-2026-109209: All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customfields[embedcode]' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is possible because the savemetadata() handler returns early when $POST['posttype'] is absent — a condition always true during XML-RPC requests — and the plugin unconditionally grants Subscribers the publishaiovgvideos capability, making this exploitable by any authenticated user via a single wp.newPost XML-RPC call.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this vulnerability?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The plugin unconditionally grants Subscribers the publish_aiovg_videos capability, so no elevated WordPress role is required.
What does an attacker need to do to trigger the vulnerable path?
The attacker needs an authenticated account and access to XML-RPC. A single wp.newPost XML-RPC request containing a payload in custom_fields[embedcode] can create the malicious video post metadata.
Are sites affected under the plugin's default capability behavior?
Yes. The described issue relies on the plugin granting Subscribers the publish_aiovg_videos capability, meaning ordinary authenticated Subscriber accounts are sufficient.
What is the impact after successful exploitation?
An attacker can store arbitrary web scripts in an injected page. The scripts execute in the browser whenever a user accesses that page, potentially affecting confidentiality and integrity in that user's browser session.
How can I identify potentially affected content?
Review video posts created through XML-RPC and inspect their custom_fields[embedcode] post metadata for unexpected or script-like content. The vulnerable parameter is embedcode, and the affected versions are up to and including 4.9.7.