CVE-2026-118783 · Package
NO FIX YET · SEE WHAT TO DO
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate or escape some shortcode attributes when it outputs them in a post or page. A user with the contributor role or higher can store script that runs in the browser of anyone who views that page.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the All-in-One Video Gallery plugin older than 5.0.0 that let contributor-level or higher users create or edit posts and pages. The risk comes from shortcode attributes that are output unescaped on the page. Sites without the plugin, or with it at 5.0.0 or later, are not affected.
Not affected if no-contributor-users, plugin-at-5.0.0-or-later
Who cares all-in-one-video-gallery, wordpress, wordpress-plugin
wp plugin get all-in-one-video-gallery --field=version if WP-CLI is available.[AIO_VIDEO_GALLERY shortcode (or the plugin's shortcode name) to see where it is used.5.0.0 or laterThe All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.