CVE-2026-120838: WordPress All-in-One Video Gallery plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vector specifies low privileges, so an attacker needs an account or other access level that provides limited permissions. Exploitation also requires a user to interact with the injected content.

Q: What impact can successful exploitation have?

This is a stored XSS issue that can execute attacker-supplied script in affected pages. The supplied severity vector indicates low confidentiality, integrity, and availability impact, with impact extending beyond the vulnerable component's security authority.

Q: Which versions are affected?

All-in-One Video Gallery versions through 5.0.0 are affected. The available information does not identify a fixed version.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 5.0.0.

Affected Software

1 affected component

Plugins360 Labs All-in-One Video Gallery<=5.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress All-in-One Video Gallery to a version that resolves this vulnerability.
Fixed in 5.1.0

Event History

Nov 9, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vector specifies low privileges, so an attacker needs an account or other access level that provides limited permissions. Exploitation also requires a user to interact with the injected content.

What impact can successful exploitation have?

This is a stored XSS issue that can execute attacker-supplied script in affected pages. The supplied severity vector indicates low confidentiality, integrity, and availability impact, with impact extending beyond the vulnerable component's security authority.

Which versions are affected?

All-in-One Video Gallery versions through 5.0.0 are affected. The available information does not identify a fixed version.

CVE-2026-120838: WordPress All-in-One Video Gallery plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What impact can successful exploitation have?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What impact can successful exploitation have?

Which versions are affected?