The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 04 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |
| Title | All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-04T06:00:28.779Z
Reserved: 2026-10-28T19:22:22.055Z
Link: CVE-2026-118783
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-04T06:17:03.517
Modified: 2026-11-04T06:17:03.517
Link: CVE-2026-118783
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.