CVE-2026-118783

All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute

State: published CNA: WPScan CVSS 3.1 6.8 Medium NVD: deferred

Description

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected products

Vendor	Product	Versions
n/a	All-in-One Video Gallery	<5.0.0

References

External links from the record. They lead to third-party sites.

https://wpscan.com/vulnerability/119477bd-1b29-4e33-9040-38cb6f0ae623/ exploit, technical-description, vdb-entry

Dates

Reserved: 2026-10-28
Published: 2026-11-04
Updated: 2026-11-04

CVSS

6.8 Medium

Version: 3.1
Source: ADP (CISA-ADP)
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.235% probability of exploitation activity in the next 30 days

Percentile: 14.621%
Score date: 2026-11-10
Model: v2026.06.15

Weakness

CWE-79 Cross-site scripting (XSS)

NVD

Status: Deferred
Published: 2026-11-04
Modified: 2026-11-04

6.8 Medium CVSS 3.1 · CISA-ADP, secondary
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

This CVE at nvd.nist.gov