CVE-2026-109209

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customfieldsembedcode' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output...