CVE-2026-118783: All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute
Published Nov 4, 2026
·Updated
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Event History
Nov 4, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
A user with the WordPress contributor role or a higher-privileged role can exploit it by supplying malicious values in affected shortcode attributes.
2
Where does the malicious code execute?
The payload is stored in a page or post containing the shortcode and can execute when that content is rendered to a visitor.
3
Are versions 5.0.0 and later affected?
The issue is described as affecting plugin versions before 5.0.0.