CVE-2026-120408: All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta

Q: Who can exploit this issue?

A user with the Subscriber role or higher can exploit it, provided they can write the affected video thumbnail URL post-meta value outside the plugin's own editor. The stored payload is triggered when an administrator views the admin video list.

Q: Are default installations affected?

The issue affects All-in-One Video Gallery versions before 5.1.0. Exploitation depends on whether a low-privileged user can modify the affected image post-meta field through a path outside the plugin editor.

Q: How can I determine whether an administrator may already be exposed?

Review video post-meta thumbnail URL values, particularly the affected image field, for unexpected or script-like content written by untrusted users. Administrators are exposed when viewing the admin video list containing a malicious stored value.

Q: What should be done if an immediate update is not possible?

Restrict untrusted users, including Subscribers, from any mechanism that can write video thumbnail URL post meta outside the plugin editor. Review and remove suspicious stored thumbnail URL values before administrators access the video list.

Published Nov 6, 2026

Updated

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with the Subscriber role or higher can exploit it, provided they can write the affected video thumbnail URL post-meta value outside the plugin's own editor. The stored payload is triggered when an administrator views the admin video list.

Are default installations affected?

The issue affects All-in-One Video Gallery versions before 5.1.0. Exploitation depends on whether a low-privileged user can modify the affected image post-meta field through a path outside the plugin editor.

How can I determine whether an administrator may already be exposed?

Review video post-meta thumbnail URL values, particularly the affected image field, for unexpected or script-like content written by untrusted users. Administrators are exposed when viewing the admin video list containing a malicious stored value.

What should be done if an immediate update is not possible?

Restrict untrusted users, including Subscribers, from any mechanism that can write video thumbnail URL post meta outside the plugin editor. Review and remove suspicious stored thumbnail URL values before administrators access the video list.

CVE-2026-120408: All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta

Event History

Frequently Asked Questions

Who can exploit this issue?

Are default installations affected?

How can I determine whether an administrator may already be exposed?

What should be done if an immediate update is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are default installations affected?

How can I determine whether an administrator may already be exposed?

What should be done if an immediate update is not possible?