CVE-2026-120408 All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored...

CVE-2026-120408

The All-in-One Video Gallery WordPress plugin, in versions prior to 5.1.0 , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to escape a video's stored thumbnail URL before displaying it in the admin video list and fails to sanitize this value when wri...