---
id: "CVE-2026-114693"
kind: "vulnerability"
aliases: ["CVE-2026-114693"]
title: "All-in-One Video Gallery WordPress plugin: stored XSS through version 4.9.7"
severity: "medium"
cvss: 6.5
epss: 0.00224
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["newer-version", "plugin-not-installed"]
published_at: "2026-10-24T08:16:52+00:00"
first_seen_at: "2026-10-24T08:47:15+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114693", "first_seen_at": "2026-10-24T08:47:15+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114693", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# All-in-One Video Gallery WordPress plugin: stored XSS through version 4.9.7

The All-in-One Video Gallery WordPress plugin by Plugins360 Labs fails to neutralize input before writing it into pages, so stored script can be saved and later run in visitors' browsers. An attacker who can get such content saved can run JavaScript in the context of other users, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen, or in `wp-content/plugins/all-in-one-video-gallery/`, and see whether it is `4.9.7` or older
- Run `wp plugin get all-in-one-video-gallery --field=version` with WP-CLI

## Fix

- Update All-in-One Video Gallery to a version later than `4.9.7` once the vendor publishes one (fixed version unknown from the sources)
- If no fixed version is available, deactivate the plugin until it is patched

## Timeline

- 2026-10-24T08:47:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114693
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114693

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 4.9.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_