All-in-One Video Gallery EUVD-2026-114587

No authentication and no user interaction are required (PR:N/UI:N): the player page is reachable by unauthenticated remote users on any site running the plugin before 5.0.0. The concrete prerequisite is that the attacker supplies the ID of a non-published video (private, draft, pending, scheduled, or trashed), which is practically enumerable by iterating IDs. Exploitation is materially LIMITED in scope: it discloses only the video title and source URL(s), not the full private content or any site credentials, and it does not affect integrity or availability. It further depends on the vulnerable version being installed with publicly accessible player pages (the plugin's default behavior).

This is a genuine but low-to-moderate priority information-disclosure issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated weakness, which matches the description's claim that unauthenticated users can reach the player page by video ID. However, the confidentiality impact is correctly scored as Low (C:L) and integrity/availability as None, because only metadata - the video title and source URLs - of non-published videos leaks, not the full private content, so the 5.3 Medium base score is not understated. The EPSS score of 0.16% (5th percentile) indicates very low predicted exploitation probability, and SSVC reports Exploitation: none, meaning no observed exploitation; this is NOT in CISA KEV. The one signal that modestly raises attention is SSVC Automatable: yes - enumerating sequential video IDs is trivially scriptable - which aligns with the vendor/priority 'this_month' decision label rather than an emergency. In short, this is a real, easily-triggered leak of limited-sensitivity data, not a high-CVSS-but-illusory issue; the low EPSS reflects limited attacker interest in low-impact metadata disclosure rather than any doubt about exploitability. No POC or exploit reference is included in the input, so exploitation status rests on the vendor advisory alone.

An unauthenticated attacker requests the All-in-One Video Gallery player page while supplying the ID of a video that is private, draft, pending, scheduled, or trashed, and the plugin renders it without checking publication status. The attacker scripts a sweep over sequential video IDs (Automatable: yes) to harvest the titles and source URLs of unpublished videos - for example recovering the location of an embargoed or internal video file. No public exploit code is identified in the provided data.