All-in-One Video Gallery CVE-2026-109974

Exploitation requires an authenticated WordPress account with contributor-level privileges or above on a site running the All-in-One Video Gallery plugin version 4.9.7 or earlier (PR:L per the CVSS vector). The attacker injects the payload via the plugin's 'more_link' parameter, which is stored due to insufficient input sanitization and output escaping. Execution of the payload requires a subsequent victim to access the page containing the injected content; the impact is realized in that victim's browser context. Limiting factors: the contributor-privilege prerequisite excludes unauthenticated/public attackers, the plugin must be installed and the vulnerable video feature used, and a separate victim must view the injected page for the script to fire.

This is a moderate-severity stored XSS (CVSS 6.4) in a WordPress plugin, and the signals converge on a measured rather than urgent priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N confirms network-based, low-complexity exploitation but requires authenticated access at contributor level or above (PR:L), which materially limits the attacker pool to users who already have a foothold in wp-admin. The scope change (S:C) with low confidentiality and integrity impact (C:L/I:L/A:N) reflects that injected script executes in the browser context of other users (including higher-privileged ones) viewing the affected page, enabling session/credential theft or admin-action abuse within the victim's browser. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. KEV status is not listed (no active exploitation claimed), and no verified working exploit is provided - the references are the Wordfence advisory and WordPress plugin source/changeset links, not weaponized exploit code. The vuln.today decision label is 'this_month', consistent with a real-but-not-emergency issue: a genuine vulnerability warranting prompt patching but not immediate incident response. Overall this is a legitimate issue to remediate on a normal patch cadence, not a high-CVSS-but-illusory risk, though the contributor-privilege prerequisite keeps it below the tier of unauthenticated XSS.

An attacker with contributor-level (or higher) access to a WordPress site running the plugin crafts a post/page using the plugin's video functionality and injects malicious JavaScript into the 'more_link' parameter, which is stored without sufficient sanitization. When an administrator or other user later views the page, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. No public working exploit is verified in the provided data, though the vulnerable code paths are disclosed in the referenced plugin source.