All-in-One Video Gallery EUVD-2026-116738

Exploitation requires an authenticated account with the WordPress contributor role or higher on the target site, the ability to embed the All-in-One Video Gallery shortcode into a page/post, and injection of a malicious value into one of the shortcode attributes that the plugin fails to validate/escape on output. It additionally requires a second actor - an administrator or other visitor - to view the page/post where the shortcode is embedded for the stored script to fire (user interaction). Limiting factors: this is only exploitable where contributor+ accounts are granted to less-trusted users (e.g. multi-author/community sites); single-admin installations have little exposure. The specific vulnerable shortcode attributes are not enumerated in the available sources, and the plugin must be at a version before 5.0.0.

This is a moderate, authenticated stored XSS in the All-in-One Video Gallery WordPress plugin, and the signals converge on it being a 'patch in normal cycle' issue rather than an emergency. The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) is network-reachable and low-complexity but requires privileges and victim interaction. Note a discrepancy: the description says only the 'contributor role and above' is needed, which is a LOW-privilege WordPress role, yet the supplied vector encodes PR:H, and it also rates C:H/I:H/A:H and S:U, which is unusually high and scope-unchanged for a reflected-into-page stored XSS - these impact/privilege metrics appear inflated versus the described mechanism and should be verified with the vendor/WPScan. EPSS is low (0.15%, 4th percentile) and SSVC reports Exploitation: none and Automatable: no, both arguing against widespread opportunistic attacks, while SSVC Technical Impact: total mirrors the (questionable) high CVSS impact rather than independent confirmation. There is no CISA KEV listing. A PoC reference exists via WPScan but is not verified as working exploit code. The vuln.today decision label is 'this_month', consistent with a real but non-urgent priority: exploitation requires an already-authenticated low-trust user and an administrator subsequently viewing the content, so real-world risk is concentrated in multi-author sites that grant contributor+ accounts to semi-trusted users.

A multi-author WordPress site grants a semi-trusted user a contributor (or higher) account; that user embeds an All-in-One Video Gallery shortcode with a malicious attribute value that is not escaped on output. When an administrator or other visitor opens the page/post containing the shortcode, the injected script executes in their browser session, enabling session/cookie theft or admin-action abuse. A public PoC reference exists (WPScan) but is not verified as working exploit code.