EUVD-2026-118194

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'customfields.value.label for key='track'' parameter in all versions up to, and including, 5.0.0 due to insufficient...

CVE-2026-116545 All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'customfields.value.label for key='track'' parameter in all versions up to, and including, 5.0.0 due to insufficient...

CVE-2026-116545

The All-in-One Video Gallery plugin for WordPress (versions up to and including 5.0.0 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The flaw exists because of insufficient input sanitization and output escaping in the custom_fields[].value.label (for key='track') parameter. An ...

CVE-2026-116545: plugins360: The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is…

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'customfields.value.label for key='track'' parameter in all versions up to, and including, 5.0.0 due to insufficient...