{"id":"CVE-2026-116545","kind":"vulnerability","aliases":["CVE-2026-116545"],"related":[],"title":"WordPress video gallery plugin: stored XSS via track label field","description":"The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'custom_fields[].value.label (for key='track')' parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site's Player Library option to be configured as Plyr/Vidstack (aiovg_player_settings[player]='vidstack') rather than the Video.js default, as the DOM innerHTML sink exists only in the Plyr/Vidstack template path.","summary":"The All-in-One Video Gallery WordPress plugin up to and including 5.0.0 does not sanitize a custom field label for subtitle tracks. An authenticated subscriber can store a script that runs in the browser of any visitor who opens the affected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["all-in-one-video-gallery","package","wordpress","wordpress-plugin"],"not_affected_if":["no-untrusted-subscribers","plugin-not-installed","videojs-default-player"],"how_to_check":"- Check whether the plugin is installed and its version is `5.0.0` or lower in the WordPress plugins screen.\n- Check the plugin setting `aiovg_player_settings[player]`; the flaw applies only when it is `vidstack` (Plyr/Vidstack) rather than the Video.js default.","fix":null,"status":"open","published_at":"2026-11-06T12:17:17+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","triaged_at":"2026-11-06T12:42:48+00:00","updated_at":"2026-11-06T12:42:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T12:42:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WordPress video gallery plugin: stored XSS via track label field","impact":"medium","summary":"The All-in-One Video Gallery WordPress plugin up to and including 5.0.0 does not sanitize a custom field label for subtitle tracks. An authenticated subscriber can store a script that runs in the browser of any visitor who opens the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","all-in-one-video-gallery"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in visitors' browsers, hijacking sessions or defacing pages.","analyst_note":"","how_to_check":"- Check whether the plugin is installed and its version is `5.0.0` or lower in the WordPress plugins screen.\n- Check the plugin setting `aiovg_player_settings[player]`; the flaw applies only when it is `vidstack` (Plyr/Vidstack) rather than the Video.js default.","plain_action":"","needs_analyst":false,"not_affected_if":["videojs-default-player","plugin-not-installed","no-untrusted-subscribers"],"who_is_affected":"Sites running the All-in-One Video Gallery plugin at version 5.0.0 or earlier with the Player Library option set to Plyr/Vidstack. Exposure needs a logged-in subscriber-level account, so sites with open registration or untrusted contributors are the most exposed. Sites on the Video.js default or without the plugin can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000737,"input_tokens":4424,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116545':13A,16A '-2026':12A,15A '5.0.0':41B,119C 'access':139C,155C 'affect':70B 'aiovg':172C 'all-in-on':29B,73C 'all-in-one-video-galleri':17B 'arbitrari':144C 'attack':134C 'authent':53B,133C 'base':98C 'browser':63B 'configur':169C 'cross':100C 'cross-sit':99C 'custom':46B,105C 'cve':11A,14A 'default':181C 'dom':97C,184C 'dom-bas':96C 'due':120C 'escap':127C 'execut':151C 'exist':187C 'exploit':159C 'field':10A,47B,106C 'galleri':3A,22B,34B,78C,81C 'host':87C 'includ':40B,118C 'inject':143C,157C 'innerhtml':185C 'input':123C 'insuffici':122C 'key':109C 'label':9A,48B 'level':138C 'librari':165C 'make':129C 'one':20B,32B,76C 'open':68B 'option':166C 'output':126C 'packag':23B 'page':71B,148C,158C 'paramet':111C 'path':193C 'player':80C,164C,173C,175C 'plugin':4A,27B,36B,89C 'plyr/vidstack':171C,191C 'possibl':131C 'rather':177C 'requir':160C 'run':60B 'sanit':44B,124C 'script':58B,102C,146C 'self':86C 'self-host':85C 'set':174C 'sink':186C 'site':101C,162C 'store':5A,56B,95C 'subscrib':54B,137C 'subscriber-level':136C 'subtitl':50B 'templat':192C 'track':8A,51B,110C 'user':154C 'value.label':107C 'version':114C 'via':7A,103C 'video':2A,21B,33B,77C,79C,88C 'video.js':180C 'vidstack':176C 'vimeo':84C 'visitor':66B 'vulner':93C 'web':145C 'whenev':152C 'wordpress':1A,24B,26B,35B,91C 'wordpress-plugin':25B 'xss':6A 'youtub':83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the All-in-One Video Gallery plugin at version 5.0.0 or earlier with the Player Library option set to Plyr/Vidstack. Exposure needs a logged-in subscriber-level account, so sites with open registration or untrusted contributors are the most exposed. Sites on the Video.js default or without the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["allinonevideogallery","medium","package","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-116545':13A,16A '-2026':12A,15A 'cve':11A,14A 'field':10A 'galleri':3A 'label':9A 'plugin':4A 'store':5A 'track':8A 'via':7A 'video':2A 'wordpress':1A 'xss':6A","search_b":"'5.0.0':41B 'affect':70B 'all-in-on':29B 'all-in-one-video-galleri':17B 'authent':53B 'browser':63B 'custom':46B 'field':47B 'galleri':22B,34B 'includ':40B 'label':48B 'one':20B,32B 'open':68B 'packag':23B 'page':71B 'plugin':27B,36B 'run':60B 'sanit':44B 'script':58B 'store':56B 'subscrib':54B 'subtitl':50B 'track':51B 'video':21B,33B 'visitor':66B 'wordpress':24B,26B,35B 'wordpress-plugin':25B","search_c":"'5.0.0':119C 'access':139C,155C 'aiovg':172C 'all-in-on':73C 'arbitrari':144C 'attack':134C 'authent':133C 'base':98C 'configur':169C 'cross':100C 'cross-sit':99C 'custom':105C 'default':181C 'dom':97C,184C 'dom-bas':96C 'due':120C 'escap':127C 'execut':151C 'exist':187C 'exploit':159C 'field':106C 'galleri':78C,81C 'host':87C 'includ':118C 'inject':143C,157C 'innerhtml':185C 'input':123C 'insuffici':122C 'key':109C 'level':138C 'librari':165C 'make':129C 'one':76C 'option':166C 'output':126C 'page':148C,158C 'paramet':111C 'path':193C 'player':80C,164C,173C,175C 'plugin':89C 'plyr/vidstack':171C,191C 'possibl':131C 'rather':177C 'requir':160C 'sanit':124C 'script':102C,146C 'self':86C 'self-host':85C 'set':174C 'sink':186C 'site':101C,162C 'store':95C 'subscrib':137C 'subscriber-level':136C 'templat':192C 'track':110C 'user':154C 'value.label':107C 'version':114C 'via':103C 'video':77C,79C,88C 'video.js':180C 'vidstack':176C 'vimeo':84C 'vulner':93C 'web':145C 'whenev':152C 'wordpress':91C 'youtub':83C","first_public_at":"2026-11-06T12:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116545","severity":null,"published_at":"2026-11-06T12:17:17+00:00","modified_at":"2026-11-06T12:17:17+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","fetched_at":"2026-11-06T12:41:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}