CVE-2026-119259 · Package
NO FIX YET · SEE WHAT TO DO
The All-in-One Video Gallery WordPress plugin, before version 5.1.0, does not verify the type, status or ownership of a post before writing its view count and duration data. An unauthenticated visitor can therefore change that metadata on any post, including private and draft posts, and inflate view counts without limit.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any WordPress site running the All-in-One Video Gallery plugin before 5.1.0 is exposed, because the flaw is reachable without logging in. The impact is limited to view count and duration metadata, but it can reach private and draft posts. Sites that do not run this plugin can skip it.
Not affected if plugin-not-installed, version-5.1.0-or-later
Who cares all-in-one-video-gallery, wordpress, wordpress-plugin
5.1.0 or later.The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.