All-in-One Video Gallery CVE-2026-114693

Exploitation requires an authenticated account with at least low privileges able to submit content the plugin stores and renders (PR:L), plus a subsequent victim viewing the affected page (UI:R) for the stored payload to fire. This limits realistic risk: fully unauthenticated exploitation is not indicated, and the attack depends on a privileged or trusted user rendering the injected content. The specific plugin feature, field, or parameter that carries the injectable input is not described in the available sources.

This is a medium-severity stored cross-site scripting flaw (CVSS 6.5) in the All-in-One Video Gallery WordPress plugin, reported by Patchstack and prioritized by vuln.today as 'this_month' rather than an urgent/act_now item. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation that nonetheless requires some authenticated privilege (PR:L) and victim interaction (UI:R), with a scope change (S:C) and only limited impact to confidentiality, integrity and availability. No CISA KEV listing is present, so there is no public evidence of active exploitation. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. No public exploit or PoC artifact was provided - the sole reference is the Patchstack advisory database entry, not working exploit code. Taken together, the signals point to a genuine but non-emergency web-application vulnerability: real enough to patch on a normal monthly cycle, but not a drop-everything priority, consistent with the 'this_month' decision label and the authenticated/interaction-gated nature of stored XSS.

An attacker holding a low-privileged authenticated account (for example a contributor- or author-level user permitted to create video gallery content) injects a malicious script payload into a plugin field that is stored and later rendered. When a higher-privileged user such as an administrator views the affected page, the stored script executes in their browser session. No public exploit code was identified in the provided data, and the exact injection point is not described in the available sources.