Live › vulnerability › CVE-2026-118629
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering its player page. An unauthenticated visitor who knows a video's ID can read the title and source URLs of private, draft, pending, scheduled and trashed videos.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Sites running the All-in-One Video Gallery WordPress plugin before 5.0.0 that host videos not meant to be public. An attacker needs only a video ID, with no login. Sites without this plugin, or on 5.0.0 or later, are not affected.
No product ranges from the sources yet.
wp plugin get all-in-one-video-gallery --field=version5.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.
This page as .md · .json · in your agent: get_signal("CVE-2026-118629")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.