All-in-One Video Gallery CVE-2026-109209

Requires: (1) a WordPress site running All-in-One Video Gallery version ≤4.9.7; (2) an authenticated account at subscriber level or above - the barrier is low because the plugin unconditionally grants Subscribers the publish_aiovg_videos capability, and lower still on sites permitting open user registration; (3) the WordPress XML-RPC endpoint reachable/enabled (default-on), since the sanitization bypass specifically relies on the XML-RPC code path where $_POST['post_type'] is absent, causing save_meta_data() to return before sanitizing the custom_fields[embedcode] value. Limiting factors: exploitation is not fully unauthenticated (an account is needed); sites that disable or block XML-RPC remove the described bypass vector; and the stored payload only fires when a user subsequently accesses the injected page. The complete fix is updating to the patched release (changeset 3759353); no partial mitigation is stated in the sources.

Signals are moderate but internally consistent, with one feature that raises practical concern above the 6.4 base score. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity, authenticated (PR:L) stored XSS with a scope change (script executes in the victim's browser authority) and Low confidentiality/integrity impact, no availability impact. The key amplifier is in the description rather than the score: the plugin unconditionally grants Subscribers the publish_aiovg_videos capability and the save_meta_data() sanitization is bypassed on the XML-RPC path (where $_POST['post_type'] is always absent), so the PR:L barrier is effectively 'any registered user' - meaningful on sites that allow open registration. Exploitation status is 'no public exploit identified at time of analysis' (no KEV, and the references are the Wordfence advisory plus source-code/changeset links, not a working exploit). The vuln.today Decision label is 'this_month' - a schedule-and-patch priority, not act_now/emergency. EPSS is NOT provided in the input and KEV status is absent, so widespread-exploitation probability cannot be quantified from the data given. Net: a genuine but medium-urgency issue - real because the authentication bar is unusually low for a subscriber-tier account, tempered because impact is limited to XSS (no direct RCE/data-theft of secrets claimed) and no active exploitation or PoC is evidenced.

An attacker holding (or self-registering) a subscriber-level account on a vulnerable WordPress site sends a single wp.newPost XML-RPC request setting the custom_fields[embedcode] meta value to a malicious script; because the XML-RPC path omits $_POST['post_type'], save_meta_data() returns early and skips sanitization, storing the payload. The script then executes in the browser of any user who views the resulting video page, including administrators. No public exploit code is identified in the provided sources (only the Wordfence advisory and plugin source/changeset references).