CVE-2026-114693: WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 4.9.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/all-in-one-video-galleryto a version that resolves this vulnerability.Fixed in 5.0.0
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low privileges (PR:L) and that user interaction is required (UI:R). The attack can be performed over the network (AV:N) with low attack complexity (AC:L).
Which deployments should be treated as potentially affected?
Deployments of All-in-One Video Gallery versions through 4.9.7 should be considered affected. The affected-version range begins at an unspecified earlier version and extends through 4.9.7.
What is the expected security impact if exploitation succeeds?
The CVSS vector indicates low confidentiality, integrity, and availability impact, with a scope change (S:C). The vulnerability is classified as stored cross-site scripting.