CVE-2026-109974

9th percentile - higher than 9% of all known CVEs

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Attackers can execute arbitrary scripts in users' browsers, potentially leading to session theft, account takeover, or content modification. This may harm site users and the organization's reputation.

Update the All-in-One Video Gallery plugin to a version later than 4.9.7. Until then, restrict content publishing for contributor-level users and monitor for unusual scripts in content.