---
id: "CVE-2026-119259"
page: "https://infrastack.ai/live/CVE-2026-119259"
kind: "vulnerability"
aliases: ["CVE-2026-119259"]
title: "WordPress video gallery plugin lets visitors alter view counts on any post"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["all-in-one-video-gallery", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "version-5.1.0-or-later"]
published_at: "2026-11-06T06:16:41+00:00"
first_seen_at: "2026-11-06T06:40:12+00:00"
updated_at: "2026-11-06T06:41:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119259", "first_seen_at": "2026-11-06T06:40:12+00:00"}]
exploit_sources: []
---

# WordPress video gallery plugin lets visitors alter view counts on any post

Link for people: https://infrastack.ai/live/CVE-2026-119259 (this .md is for agents)

The All-in-One Video Gallery WordPress plugin, before version 5.1.0, does not verify the type, status or ownership of a post before writing its view count and duration data. An unauthenticated visitor can therefore change that metadata on any post, including private and draft posts, and inflate view counts without limit.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the All-in-One Video Gallery plugin in the WordPress admin under Plugins.
- Confirm whether the plugin is active on the site.

## Fix

- All-in-One Video Gallery plugin: move to `5.1.0` or later.

## Timeline

- 2026-11-06T06:40:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119259

## From the sources

The All-in-One Video Gallery  WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_