CVE-2026-116545: All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'customfields[].value.label (for key='track')' parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site's Player Library option to be configured as Plyr/Vidstack (aiovgplayersettings[player]='vidstack') rather than the Video.js default, as the DOM innerHTML sink exists only in the Plyr/Vidstack template path.
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Only sites using an affected version up to 5.0.0 and configured with the Player Library set to Plyr/Vidstack are exposed through this issue. Sites using the default Video.js player are not affected by this specific DOM innerHTML sink.
What level of access does an attacker need?
An attacker must have an authenticated WordPress account with at least Subscriber-level permissions. No user interaction is required from the attacker, but the injected page must later be viewed for the stored script to execute.
What should be checked during triage?
Check whether the plugin version is 5.0.0 or earlier and inspect the Player Library configuration for aiovg_player_settings[player] set to vidstack. Review video post metadata for track custom fields whose label value may contain injected script or HTML.
What mitigation is available if the plugin cannot be patched immediately?
Configure the Player Library to use Video.js instead of Plyr/Vidstack, since the vulnerable innerHTML template path is limited to Plyr/Vidstack. Also restrict or review Subscriber and higher accounts that can submit the affected track label metadata.