CVE-2022-2633

CVE-2022-2633 affects the WordPress All-In-One Video Gallery plugin (versions up to 2.6.0). The root cause is improper handling of the dl parameter in ~/public/video.php, enabling unauthenticated arbitrary file downloads and server-side request forgery (SSRF). Impact is unauthenticated access to ...

CVE-2021-24970

The CVE-2021-24970 entry concerns the WordPress All-In-One Video Gallery plugin before version 2.5.0, where the admin dashboard uses a tab parameter in a require statement without proper sanitization/validation, causing a Local File Inclusion (LFI). Public sources in connected documents confirm t...

CVE-2024-31248

CVE-2024-31248 concerns the WordPress plugin “All-in-One Video Gallery” (All-in-One Video Gallery) with a Missing Authorization vulnerability affecting versions up to and including 3.5.2. The incident is described as a Missing Authorization issue, harming confidentiality, integrity, and availabil...

CVE-2024-6629

CVE-2024-6629 affects All-in-One Video Gallery for WordPress; versions up to and including 3.7.1 are vulnerable to Stored Cross-Site Scripting via the Video shortcode due to insufficient input sanitization and output escaping. Exploitation requires at least contributor-level authentication. The v...