CVE-2021-24970

🗓️ 13 Dec 2021 10:41:31Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 66 Views🌐 WEB

The All-in-One Video Gallery WordPress plugin before 2.5.0 has a Local File Inclusion issu

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2021-24970	27 Apr 202309:58	–	circl
CNNVD	WordPress 插件路径遍历漏洞	13 Dec 202100:00	–	cnnvd
CNVD	WordPress plugin path traversal vulnerability (CNVD-2021-102395)	15 Dec 202100:00	–	cnvd
Cvelist	CVE-2021-24970 All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion	13 Dec 202110:41	–	cvelist
Nuclei	WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion	2 Jul 202609:36	–	nuclei
NVD	CVE-2021-24970	13 Dec 202111:15	–	nvd
OSV	CVE-2021-24970	13 Dec 202111:15	–	osv
Patchstack	WordPress All-in-One Video Gallery plugin <= 2.4.9 - Local File Inclusion (LFI) vulnerability	15 Nov 202100:00	–	patchstack
Prion	Design/Logic Flaw	13 Dec 202111:15	–	prion
RedhatCVE	CVE-2021-24970	22 May 202519:24	–	redhatcve

NVD

Vulners

Node

plugins360 all-in-one_video_galleryRange<2.5.0wordpress

[
  {
    "product": "All-in-One Video Gallery",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.5.0",
        "status": "affected",
        "version": "2.5.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/9b15d47e-43b6-49a8-b2c3-b99c92101e10

Parameter	Position	Path	Description	CWE
tab	query param	/wp-admin/admin.php?page=all-in-one-video-gallery&tab=..%2F..%2F..%2F..%2F..%2Findex	Local File Inclusion via unsanitised tab parameter used in require in admin dashboard	CWE-22

17 Jun 2026 03:41Current

6.8Medium risk

Vulners AI Score6.8

CVSS 26.5

CVSS 3.17.2

EPSS0.05898

CWE-22