CVE-2026-118629

The All-in-One Video Gallery WordPress plugin, in versions prior to 5.0.0 , contains a vulnerability where it fails to verify a video's publication status before rendering it on its player page. This security flaw allows unauthenticated users to access and view the titles and source URLs of video...

CVE-2026-118629 All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID...