CVE-2026-109209

11th percentile - higher than 11% of all known CVEs

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is possible because the save_meta_data() handler returns early when $_POST['post_type'] is absent — a condition always true during XML-RPC requests — and the plugin unconditionally grants Subscribers the publish_aiovg_videos capability, making this exploitable by any authenticated user via a single wp.newPost XML-RPC call.

Attackers can execute arbitrary scripts in users' browsers, potentially leading to session theft, account takeover, or content modification. This may harm site users and the organization's reputation.

Update the All-in-One Video Gallery plugin to a version later than 4.9.7. Until then, restrict content publishing for subscribers and monitor for unusual scripts in content.