{"id":"CVE-2026-118783","kind":"vulnerability","aliases":["CVE-2026-118783"],"related":[],"title":"All-in-One Video Gallery WordPress plugin: shortcode attributes allow stored cross-site scripting","description":"The All-in-One Video Gallery  WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.","summary":"The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate or escape some shortcode attributes when it outputs them in a post or page. A user with the contributor role or higher can store script that runs in the browser of anyone who views that page.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["all-in-one-video-gallery","package","wordpress","wordpress-plugin"],"not_affected_if":["no-contributor-users","plugin-at-5.0.0-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get all-in-one-video-gallery --field=version` if WP-CLI is available.\n- Search post and page content for the `[AIO_VIDEO_GALLERY` shortcode (or the plugin's shortcode name) to see where it is used.","fix":"- All-in-One Video Gallery WordPress plugin: move to `5.0.0` or later","status":"open","published_at":"2026-11-04T06:17:03+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","triaged_at":"2026-11-04T06:26:05+00:00","updated_at":"2026-11-04T06:26:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T06:26:05Z","model":"claude-haiku-5-5","output":{"fix":"- All-in-One Video Gallery WordPress plugin: move to `5.0.0` or later","reach":"network","title":"All-in-One Video Gallery WordPress plugin: shortcode attributes allow stored cross-site scripting","impact":"medium","summary":"The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate or escape some shortcode attributes when it outputs them in a post or page. A user with the contributor role or higher can store script that runs in the browser of anyone who views that page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","all-in-one-video-gallery"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Stored script runs in visitors' and editors' browsers, enabling session theft.","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get all-in-one-video-gallery --field=version` if WP-CLI is available.\n- Search post and page content for the `[AIO_VIDEO_GALLERY` shortcode (or the plugin's shortcode name) to see where it is used.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-at-5.0.0-or-later","no-contributor-users"],"who_is_affected":"Sites running the All-in-One Video Gallery plugin older than 5.0.0 that let contributor-level or higher users create or edit posts and pages. The risk comes from shortcode attributes that are output unescaped on the page. Sites without the plugin, or with it at 5.0.0 or later, are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000724,"input_tokens":4122,"output_tokens":623,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118783':19A,22A '-2026':18A,21A '5.0.0':44B,94C 'all-in-on':1A,35B,85C 'all-in-one-video-galleri':23B 'allow':11A,119C 'anyon':79B 'attack':134C 'attribut':10A,52B,104C 'back':108C 'browser':77B 'contributor':66B,123C 'could':118C 'cross':14A,131C 'cross-sit':13A,130C 'cve':17A,20A 'embed':116C 'escap':49B,99C 'galleri':6A,28B,40B,90C 'higher':69B 'one':4A,26B,38B,88C 'output':55B,106C 'packag':29B 'page':61B,83B 'page/post':111C 'perform':128C 'plugin':8A,33B,42B,92C 'post':59B 'role':67B,124C 'run':74B 'script':16A,72B,133C 'shortcod':9A,51B,103C,114C 'site':15A,132C 'store':12A,71B,129C 'user':63B,120C 'valid':47B,97C 'video':5A,27B,39B,89C 'view':81B 'wordpress':7A,30B,32B,41B,91C 'wordpress-plugin':31B","nicknames":[],"mitigations":[],"who_affected":"Sites running the All-in-One Video Gallery plugin older than 5.0.0 that let contributor-level or higher users create or edit posts and pages. The risk comes from shortcode attributes that are output unescaped on the page. Sites without the plugin, or with it at 5.0.0 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["allinonevideogallery","medium","package","wordpress","wordpressplugin"],"campaign_type":null,"first_public_at":"2026-11-04T06:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118783","severity":null,"published_at":"2026-11-04T06:17:03+00:00","modified_at":"2026-11-04T06:17:03+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","fetched_at":"2026-11-04T06:25:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}