{"id":"CVE-2026-120408","kind":"vulnerability","aliases":["CVE-2026-120408"],"related":[],"title":"WordPress video gallery plugin: stored XSS via thumbnail URL field","description":"The All-in-One Video Gallery  WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.","summary":"The All-in-One Video Gallery WordPress plugin does not escape a video's stored thumbnail URL before showing it in the admin video list. A low-privileged user such as a Subscriber can plant script that runs in an administrator's browser.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["all-in-one-video-gallery","package","wordpress","wordpress-plugin"],"not_affected_if":["no-user-registration","plugin-not-installed","version-5.1.0-or-later"],"how_to_check":"- Check whether the All-in-One Video Gallery plugin is installed and its version in the WordPress admin Plugins screen\n- Compare the installed version against `5.1.0`; versions below it are listed as affected\n- Check whether open user registration gives accounts the Subscriber role","fix":"- All-in-One Video Gallery WordPress plugin: move to `5.1.0` or later","status":"open","published_at":"2026-11-06T06:16:41+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","triaged_at":"2026-11-06T06:41:46+00:00","updated_at":"2026-11-06T06:41:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T06:41:46Z","model":"claude-haiku-5-5","output":{"fix":"- All-in-One Video Gallery WordPress plugin: move to `5.1.0` or later","reach":"network","title":"WordPress video gallery plugin: stored XSS via thumbnail URL field","impact":"medium","summary":"The All-in-One Video Gallery WordPress plugin does not escape a video's stored thumbnail URL before showing it in the admin video list. A low-privileged user such as a Subscriber can plant script that runs in an administrator's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","all-in-one-video-gallery"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Stored script runs in administrator sessions, enabling account takeover on the site","analyst_note":"","how_to_check":"- Check whether the All-in-One Video Gallery plugin is installed and its version in the WordPress admin Plugins screen\n- Compare the installed version against `5.1.0`; versions below it are listed as affected\n- Check whether open user registration gives accounts the Subscriber role","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-5.1.0-or-later","no-user-registration"],"who_is_affected":"Sites running the All-in-One Video Gallery WordPress plugin before 5.1.0. Exposure needs an account with at least the Subscriber role, so sites that allow no public registration and have no shared accounts carry less risk. Administrators who open the admin video list are the target.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":4240,"output_tokens":575,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120408':13A,16A '-2026':12A,15A '5.1.0':83C 'admin':51B,98C 'administr':70B,133C 'all-in-on':29B,74C 'all-in-one-video-galleri':17B 'allow':115C 'attack':131C 'browser':72B 'cross':128C 'cross-sit':127C 'cve':11A,14A 'editor':114C 'escap':39B,86C 'field':10A 'galleri':3A,22B,34B,79C 'list':53B,100C 'low':56B,121C 'low-privileg':55B 'one':20B,32B,77C 'output':94C 'outsid':111C 'packag':23B 'perform':125C 'plant':64B 'plugin':4A,27B,36B,81C 'privileg':57B 'role':119C 'run':67B 'sanitis':104C 'script':65B,130C 'show':47B 'site':129C 'store':5A,43B,90C,126C 'subscrib':62B,123C 'thumbnail':8A,44B,91C 'url':9A,45B,92C 'user':58B,116C 'valu':106C 'via':7A 'video':2A,21B,33B,41B,52B,78C,88C,99C 'wordpress':1A,24B,26B,35B,80C 'wordpress-plugin':25B 'written':110C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the All-in-One Video Gallery WordPress plugin before 5.1.0. Exposure needs an account with at least the Subscriber role, so sites that allow no public registration and have no shared accounts carry less risk. Administrators who open the admin video list are the target.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["allinonevideogallery","medium","package","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-120408':13A,16A '-2026':12A,15A 'cve':11A,14A 'field':10A 'galleri':3A 'plugin':4A 'store':5A 'thumbnail':8A 'url':9A 'via':7A 'video':2A 'wordpress':1A 'xss':6A","search_b":"'admin':51B 'administr':70B 'all-in-on':29B 'all-in-one-video-galleri':17B 'browser':72B 'escap':39B 'galleri':22B,34B 'list':53B 'low':56B 'low-privileg':55B 'one':20B,32B 'packag':23B 'plant':64B 'plugin':27B,36B 'privileg':57B 'run':67B 'script':65B 'show':47B 'store':43B 'subscrib':62B 'thumbnail':44B 'url':45B 'user':58B 'video':21B,33B,41B,52B 'wordpress':24B,26B,35B 'wordpress-plugin':25B","search_c":"'5.1.0':83C 'admin':98C 'administr':133C 'all-in-on':74C 'allow':115C 'attack':131C 'cross':128C 'cross-sit':127C 'editor':114C 'escap':86C 'galleri':79C 'list':100C 'low':121C 'one':77C 'output':94C 'outsid':111C 'perform':125C 'plugin':81C 'role':119C 'sanitis':104C 'script':130C 'site':129C 'store':90C,126C 'subscrib':123C 'thumbnail':91C 'url':92C 'user':116C 'valu':106C 'video':78C,88C,99C 'wordpress':80C 'written':110C","first_public_at":"2026-11-06T06:16:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120408","severity":null,"published_at":"2026-11-06T06:16:41+00:00","modified_at":"2026-11-06T06:16:41+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","fetched_at":"2026-11-06T06:40:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}