CVE-2026-19075

The CVE-2026-19075 issue affects All-in-One Video Gallery prior to version 4.9.2. The vulnerability occurs in the public, unauthenticated file-download handler invoked via ?vdl= on aiovg_videos posts (public/video.php, AIOVG_Public_Video::download_video()). The handler reads the post’s mp4 meta v...