All-in-One Video Gallery vulnerabilities

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page. This allows unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.

The WordPress plugin 'All-in-One Video Gallery' (versions up to 4.9.7) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. A malicious script stored in the database executes for users visiting the site.

The All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post. It reads the post's `mp4` meta value and streams that URL's response back to the requester.

The All-in-One Video Gallery plugin for WordPress up to version 4.8.5 is vulnerable to Server-Side Request Forgery (SSRF) via the 'vdl' parameter. An authenticated attacker with subscriber-level access can make arbitrary web requests from the server, including to internal services, and read their responses.