CVE-2026-109209

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customfieldsembedcode' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output...

EUVD-2026-111564

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customfieldsembedcode' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output...

CVE-2026-109209 All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customfieldsembedcode' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output...

CVE-2026-109209

The All-in-One Video Gallery WordPress plugin (versions up to and including 4.9.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the custom_fields[embedcode] parameter due to insufficient input sanitization and output escaping. An authenticated attacker with Subscriber ...

CVE-2026-109209 All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customfieldsembedcode' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output...

CVE-2026-109209: plugins360: The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is…

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customfieldsembedcode' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output...

PT-2026-127780

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom fieldsembedcode' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and outpu...

WordPress All-in-One Video Gallery cross-site scripting vulnerability

WordPress All-in-One Video Gallery versions 4.9.7 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping for the customfieldsembedcode parameter. The savemetadata handler returns early when posttype is missing in...

player.bitgravity.com XSS vulnerability

Vulnerable URL: http://player.bitgravity.com/debug/embedcode.php?rtmpserver=rtmp%3A//enabledware.live-s.cdn.bitgravity.com/cdn-live"-confirmOPENBUGBOUNTY-"=/enabledware/secure/feed01%3Fe%3D0%2526h%3Da8a20a230796eb222a69cfacecd3e79b Details: Description| Value ---|--- Patched:| No Latest check for...