{"id":"CVE-2026-120838","kind":"vulnerability","aliases":["CVE-2026-120838"],"related":[],"title":"WordPress All-in-One Video Gallery: stored XSS lets attackers inject scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 5.0.0.","summary":"All-in-One Video Gallery, a WordPress plugin by Plugins360 Labs, does not properly neutralize input before generating web pages, allowing stored cross-site scripting. An attacker who can submit content can run scripts in the browsers of people who view the affected pages.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"all-in-one-video-gallery","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["all-in-one-video-gallery","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WordPress plugin `all-in-one-video-gallery` is installed and its installed version in the plugin list or `wp plugin list`\n- Compare the installed version against the range `5.0.0` and earlier, which the sources list as affected","fix":"- All-in-One Video Gallery: no fixed version is stated in the sources; 5.0.0 and earlier are affected","status":"open","published_at":"2026-11-09T11:17:22+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:43+00:00","updated_at":"2026-11-09T11:26:43+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T11:26:43Z","model":"claude-haiku-5-5","output":{"fix":"- All-in-One Video Gallery: no fixed version is stated in the sources; 5.0.0 and earlier are affected","reach":"internet","title":"WordPress All-in-One Video Gallery: stored XSS lets attackers inject scripts","impact":"medium","summary":"All-in-One Video Gallery, a WordPress plugin by Plugins360 Labs, does not properly neutralize input before generating web pages, allowing stored cross-site scripting. An attacker who can submit content can run scripts in the browsers of people who view the affected pages.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","all-in-one-video-gallery"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers through stored malicious content","analyst_note":"Confirm the fixed version and whether an account is needed to inject content, using the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-120838 and the plugin's WordPress.org page.","how_to_check":"- Check whether the WordPress plugin `all-in-one-video-gallery` is installed and its installed version in the plugin list or `wp plugin list`\n- Compare the installed version against the range `5.0.0` and earlier, which the sources list as affected","plain_action":"","product_name":"all-in-one-video-gallery","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the All-in-One Video Gallery WordPress plugin at version 5.0.0 or earlier are exposed. The sources do not describe which role can submit the stored content, so unknown whether an account is required. Sites that do not run this plugin can skip it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000788,"input_tokens":4565,"output_tokens":663,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120838':16A,19A '-2026':15A,18A '5.0.0':122C 'affect':78B,112C 'all':21A 'all-in-on':2A,34B,96C,113C 'all-in-one-video-galleri':26B,102C 'all-in-one-video-gallery':20A 'allow':55B,108C 'attack':11A,62B 'browser':72B 'content':66B 'cross':58B,89C 'cross-sit':57B,88C 'cve':14A,17A 'galleri':7A,31B,39B,101C,107C,118C 'gallery':25A 'generat':52B,87C 'improp':80C 'in':22A 'inject':12A 'input':50B,83C 'issu':111C 'lab':45B,95C 'let':10A 'n/a':120C 'neutral':49B,81C 'one':5A,23A,29B,37B,99C,105C,116C 'page':54B,79B,86C 'peopl':74B 'plugin':42B 'plugins360':44B,94C 'proper':48B 'run':68B 'script':13A,60B,69B,91C 'site':59B,90C 'store':8A,56B,109C 'submit':65B 'video':6A,24A,30B,38B,100C,106C,117C 'view':76B 'vulner':92C 'web':53B,85C 'wordpress':1A,33B,41B 'xss':9A 'xss.this':110C","nicknames":[],"mitigations":[],"who_affected":"Sites running the All-in-One Video Gallery WordPress plugin at version 5.0.0 or earlier are exposed. The sources do not describe which role can submit the stored content, so unknown whether an account is required. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["allinonevideogallery"],"ptokens":["all","gallery","in","one","video"],"labels":["allinonevideogallery","medium","other","vendor","wordpress"],"campaign_type":null,"search_a":"'-120838':16A,19A '-2026':15A,18A 'all':21A 'all-in-on':2A 'all-in-one-video-gallery':20A 'attack':11A 'cve':14A,17A 'galleri':7A 'gallery':25A 'in':22A 'inject':12A 'let':10A 'one':5A,23A 'script':13A 'store':8A 'video':6A,24A 'wordpress':1A 'xss':9A","search_b":"'affect':78B 'all-in-on':34B 'all-in-one-video-galleri':26B 'allow':55B 'attack':62B 'browser':72B 'content':66B 'cross':58B 'cross-sit':57B 'galleri':31B,39B 'generat':52B 'input':50B 'lab':45B 'neutral':49B 'one':29B,37B 'page':54B,79B 'peopl':74B 'plugin':42B 'plugins360':44B 'proper':48B 'run':68B 'script':60B,69B 'site':59B 'store':56B 'submit':65B 'video':30B,38B 'view':76B 'web':53B 'wordpress':33B,41B","search_c":"'5.0.0':122C 'affect':112C 'all-in-on':96C,113C 'all-in-one-video-galleri':102C 'allow':108C 'cross':89C 'cross-sit':88C 'galleri':101C,107C,118C 'generat':87C 'improp':80C 'input':83C 'issu':111C 'lab':95C 'n/a':120C 'neutral':81C 'one':99C,105C,116C 'page':86C 'plugins360':94C 'script':91C 'site':90C 'store':109C 'video':100C,106C,117C 'vulner':92C 'web':85C 'xss.this':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120838","severity":null,"published_at":"2026-11-09T11:17:22+00:00","modified_at":"2026-11-09T11:17:22+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}