Live › vulnerability › CVE-2026-114693
Go to dashboardThe All-in-One Video Gallery WordPress plugin by Plugins360 Labs fails to neutralize input before writing it into pages, so stored script can be saved and later run in visitors' browsers. An attacker who can get such content saved can run JavaScript in the context of other users, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 08:47 UTC. All times on this page are UTC.
Sites running All-in-One Video Gallery at version 4.9.7 or older are exposed, most of all sites where contributors or other lower-privileged users can enter gallery or video content. Sites that do not have the plugin installed, or run a later version, can skip it. The sources do not say which role is needed to submit the payload.
No product ranges from the sources yet.
wp-content/plugins/all-in-one-video-gallery/, and see whether it is 4.9.7 or olderwp plugin get all-in-one-video-gallery --field=version with WP-CLI4.9.7 once the vendor publishes one (fixed version unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 4.9.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-114693")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.