plugins360 Schwachstellen (CVE)

6.4Mittel

CVE-2026-116545 vor 3 Tagen

All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field

plugins360 All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'custom_fields[].value.label (for key='track')' parameter in all versions up to…

6.4Mittel

CVE-2026-109209 vor 12 Tagen

All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC

plugins360 All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and including, 4.9.7 due to i…

6.4Mittel

CVE-2026-109974 vor 12 Tagen

All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute

plugins360 All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient inp…

6.4Mittel

CVE-2026-12123 vor 4 Monaten

All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter

plugins360 All-in-One Video Gallery

The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to …

6.1Mittel

CVE-2024-13362 vor 6 Monaten

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

sebet Go Fetch Jobs (for WP Job Manager); 5starplugins Dynamic Copyright Year; peterschulznl Code Manager; bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject …

6.1Mittel

CVE-2026-1706 vor 8 Monaten

All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter

plugins360 All-in-One Video Gallery

The All-in-One Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vi' parameter in all versions up to, and including, 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthe…

4.3Mittel

CVE-2025-15516 vor 9 Monaten

All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update

plugins360 All-in-One Video Gallery

The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_callback_store_user_meta() function in versions 4.1.0 to 4.6.4. This makes it possible for authenticated attacke…

6.5Mittel

CVE-2025-14947 vor 9 Monaten

All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion

plugins360 All-in-One Video Gallery

The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_create_bunny_stream_video`, `ajax_callback_get_bunny_stream_video`, and `ajax_callback_delete_bunny_st…

8.8Hoch

CVE-2025-12957 vor 9 Monaten

All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass

plugins360 All-in-One Video Gallery

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.5.7. This is due to insufficient file type validation detecting VTT files, allowing double extension files to bypass sanitization …

8.8Hoch

CVE-2025-12966 vor 11 Monaten

All-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP

plugins360 All-in-One Video Gallery

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the resolve_import_directory() function in versions 4.5.4 to 4.5.7. This makes it possible for authenticated attackers, with Autho…

6.4Mittel

CVE-2024-6629 vor 2 Jahren

All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode

plugins360 All-in-One Video Gallery

The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping on user supplied attributes.…

8.8Hoch

CVE-2024-4670 vor 2 Jahren

All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode

plugins360 All-in-One Video Gallery; plugins360 all-in-one_video_gallery

The All-in-One Video Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.5 via the aiovg_search_form shortcode. This makes it possible for authenticated attackers, with contributor-level access and abov…

8.8Hoch

CVE-2024-4033 vor 2 Jahren

All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image

plugins360 All-in-One Video Gallery

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the aiovg_create_attachment_from_external_image_url function in all versions up to, and including, 3.6.4. This makes it possible f…

1.6%EPSS

7.5Hoch

CVE-2022-2633 vor 4 Jahren

plugins360 All-in-One Video Gallery

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for un…

36%EPSS