ALL-IN-ONE VIDEO GALLERY · CVE-2026-120409 · Package
NO FIX YET · SEE WHAT TO DO
The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page or download link. Unauthenticated visitors can obtain the media source of protected videos, such as unlisted YouTube or Vimeo links and external file URLs.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the All-in-One Video Gallery WordPress plugin before 5.1.1 that host password-protected videos. The flaw exposes the media source through the standalone player page and download link, so sites without password-protected videos or without the plugin can skip it.
Not affected if no-password-protected-videos, plugin-updated
Who cares all-in-one-video-gallery, self-hosted, wordpress
5.1.1.5.1.1 or later.The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.