CVE-2026-118629
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page. This allows unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.
Risk Assessment
Unauthenticated users can access information about non-public videos, potentially leading to disclosure of confidential content. This may compromise the confidentiality of organizational video materials.
Recommendation
Update the All-in-One Video Gallery plugin to version 5.0.0 or later. Check whether non-public videos have been exposed.
Other vulnerabilities in All-in-One Video Gallery
See all- CVE-2026-114693Medium
The WordPress plugin 'All-in-One Video Gallery' (versions up to 4.9.7) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. A malicious script stored in the database executes for users visiting the site.
- CVE-2026-19075Medium
The All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post. It reads the post's `mp4` meta value and streams that URL's response back to the requester.
- CVE-2026-12123Medium
The All-in-One Video Gallery plugin for WordPress up to version 4.8.5 is vulnerable to Server-Side Request Forgery (SSRF) via the 'vdl' parameter. An authenticated attacker with subscriber-level access can make arbitrary web requests from the server, including to internal services, and read their responses.
Original NVD description (English source)
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS