{"id":"CVE-2026-114693","kind":"vulnerability","aliases":["CVE-2026-114693"],"related":[],"title":"All-in-One Video Gallery WordPress plugin: stored XSS through version 4.9.7","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 4.9.7.","summary":"The All-in-One Video Gallery WordPress plugin by Plugins360 Labs fails to neutralize input before writing it into pages, so stored script can be saved and later run in visitors' browsers. An attacker who can get such content saved can run JavaScript in the context of other users, including administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen, or in `wp-content/plugins/all-in-one-video-gallery/`, and see whether it is `4.9.7` or older\n- Run `wp plugin get all-in-one-video-gallery --field=version` with WP-CLI","fix":"- Update All-in-One Video Gallery to a version later than `4.9.7` once the vendor publishes one (fixed version unknown from the sources)\n- If no fixed version is available, deactivate the plugin until it is patched","status":"open","published_at":"2026-10-24T08:16:52+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","triaged_at":"2026-10-25T03:47:08+00:00","updated_at":"2026-10-25T03:47:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:47:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update All-in-One Video Gallery to a version later than `4.9.7` once the vendor publishes one (fixed version unknown from the sources)\n- If no fixed version is available, deactivate the plugin until it is patched","reach":"internet","title":"All-in-One Video Gallery WordPress plugin: stored XSS through version 4.9.7","impact":"medium","summary":"The All-in-One Video Gallery WordPress plugin by Plugins360 Labs fails to neutralize input before writing it into pages, so stored script can be saved and later run in visitors' browsers. An attacker who can get such content saved can run JavaScript in the context of other users, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' and administrators' browsers","analyst_note":"Find the fixed plugin version and the privilege level required to store the payload on the Patchstack or WPScan advisory for this CVE.","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen, or in `wp-content/plugins/all-in-one-video-gallery/`, and see whether it is `4.9.7` or older\n- Run `wp plugin get all-in-one-video-gallery --field=version` with WP-CLI","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Sites running All-in-One Video Gallery at version 4.9.7 or older are exposed, most of all sites where contributors or other lower-privileged users can enter gallery or video content. Sites that do not have the plugin installed, or run a later version, can skip it. The sources do not say which role is needed to submit the payload.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":3329,"output_tokens":662,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114693':16A,19A '-2026':15A,18A '4.9.7':13A,122C 'administr':79B 'affect':112C 'all-in-on':1A,29B,96C,113C 'all-in-one-video-galleri':102C 'allow':108C 'attack':62B 'browser':60B 'content':67B 'context':74B 'cross':89C 'cross-sit':88C 'cve':14A,17A 'fail':40B 'galleri':6A,34B,101C,107C,118C 'generat':87C 'get':65B 'host':23B 'improp':80C 'includ':78B 'input':43B,83C 'issu':111C 'javascript':71B 'lab':39B,95C 'later':56B 'n/a':120C 'neutral':42B,81C 'one':4A,32B,99C,105C,116C 'packag':20B 'page':48B,86C 'plugin':8A,27B,36B 'plugins360':38B,94C 'run':57B,70B 'save':54B,68B 'script':51B,91C 'self':22B 'self-host':21B 'site':90C 'store':9A,50B,109C 'user':77B 'version':12A 'video':5A,33B,100C,106C,117C 'visitor':59B 'vulner':92C 'web':85C 'wordpress':7A,24B,26B,35B 'wordpress-plugin':25B 'write':45B 'xss':10A 'xss.this':110C","nicknames":[],"mitigations":[],"who_affected":"Sites running All-in-One Video Gallery at version 4.9.7 or older are exposed, most of all sites where contributors or other lower-privileged users can enter gallery or video content. Sites that do not have the plugin installed, or run a later version, can skip it. The sources do not say which role is needed to submit the payload.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T08:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114693","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114693","severity":null,"published_at":"2026-10-24T08:16:52+00:00","modified_at":"2026-10-24T08:16:52+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","fetched_at":"2026-10-24T08:47:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}