{"id":"CVE-2026-109974","kind":"vulnerability","aliases":["CVE-2026-109974"],"related":[],"title":"WordPress video gallery plugin: stored XSS via more_link parameter","description":"The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The All-in-One Video Gallery WordPress plugin up to and including 4.9.7 does not sanitize the 'more_link' parameter before output. An authenticated contributor can store a script that runs in the browser of anyone who opens the injected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["plugin-not-installed","trusted-users-only"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get all-in-one-video-gallery --field=version` (plugin slug assumed; confirm in the sources)\n- Review contributor-level accounts and pages that use the plugin's more_link option for unexpected script content","fix":"- Update the All-in-One Video Gallery plugin to a version later than `4.9.7` once the vendor releases one (fixed version unknown from sources)\n- Until patched, restrict contributor-level accounts or remove untrusted contributors","status":"open","published_at":"2026-10-28T03:17:09+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","triaged_at":"2026-10-28T03:32:40+00:00","updated_at":"2026-10-28T03:32:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T03:32:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the All-in-One Video Gallery plugin to a version later than `4.9.7` once the vendor releases one (fixed version unknown from sources)\n- Until patched, restrict contributor-level accounts or remove untrusted contributors","reach":"network","title":"WordPress video gallery plugin: stored XSS via more_link parameter","impact":"medium","summary":"The All-in-One Video Gallery WordPress plugin up to and including 4.9.7 does not sanitize the 'more_link' parameter before output. An authenticated contributor can store a script that runs in the browser of anyone who opens the injected page.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Stored script runs in visitors' and admins' browsers on the site.","analyst_note":"Confirm the fixed version and the plugin slug from the vendor changelog or the NVD/WPScan entry for CVE-2026-109974.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get all-in-one-video-gallery --field=version` (plugin slug assumed; confirm in the sources)\n- Review contributor-level accounts and pages that use the plugin's more_link option for unexpected script content","needs_analyst":true,"not_affected_if":["plugin-not-installed","trusted-users-only"],"who_is_affected":"Sites running the All-in-One Video Gallery plugin at version 4.9.7 or earlier where contributor-level or higher users can edit content. Sites without this plugin, or where only trusted editors have accounts, face lower risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000653,"input_tokens":3407,"output_tokens":624,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109974':13A,16A '-2026':12A,15A '4.9.7':38B,107C 'access':127C,143C 'all-in-on':26B,68C 'anyon':61B 'arbitrari':132C 'attack':122C 'authent':49B,121C 'browser':59B 'contributor':50B,125C 'contributor-level':124C 'cross':92C 'cross-sit':91C 'cve':11A,14A 'due':108C 'escap':115C 'execut':139C 'galleri':3A,31B,73C,76C 'host':20B,82C 'includ':37B,106C 'inject':65B,131C,145C 'input':111C 'insuffici':110C 'level':126C 'link':9A,44B,98C 'make':117C 'one':29B,71C 'open':63B 'output':47B,114C 'packag':17B 'page':66B,136C,146C 'paramet':10A,45B,99C 'player':75C 'plugin':4A,24B,33B,84C 'possibl':119C 'run':56B 'sanit':41B,112C 'script':54B,94C,134C 'self':19B,81C 'self-host':18B,80C 'site':93C 'store':5A,52B,90C 'user':142C 'version':102C 'via':7A,95C 'video':2A,30B,72C,74C,83C 'vimeo':79C 'vulner':88C 'web':133C 'whenev':140C 'wordpress':1A,21B,23B,32B,86C 'wordpress-plugin':22B 'xss':6A 'youtub':78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the All-in-One Video Gallery plugin at version 4.9.7 or earlier where contributor-level or higher users can edit content. Sites without this plugin, or where only trusted editors have accounts, face lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109974","severity":null,"published_at":"2026-10-28T03:17:09+00:00","modified_at":"2026-10-28T03:17:09+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","fetched_at":"2026-10-28T03:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}