All-in-One Video Gallery Plugin Stored XSS Flaws

Stored cross-site scripting in the All-in-One Video Gallery WordPress plugin through version 4.9.7 allows authenticated users with contributor-level access or higher to inject arbitrary web scripts via the 'more_link' parameter, which are stored and later execute in the browser of any user who views the affected page. The issue is rated CVSS 6.4 with changed scope and limited confidentiality and integrity impact; the supplied intelligence labels it a measured, this-month priority rather than an urgent one. No public exploit code and no CISA KEV entry are identified at time of analysis, and exploitation is constrained by the contributor-privilege prerequisite and the need for a separate victim to access the injected page.

Stored cross-site scripting in the All-in-One Video Gallery plugin for WordPress (all versions up to and including 4.9.7) lets any authenticated user at Subscriber level or above inject arbitrary web scripts through the custom_fields[embedcode] parameter, which then execute whenever a victim accesses the injected page. The required account is easy to obtain because the plugin unconditionally grants Subscribers the publish_aiovg_videos capability, and the sanitization is bypassed with a single wp.newPost XML-RPC call since save_meta_data() returns early when $_POST['post_type'] is absent. Assessed at 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code was identified at time of analysis and the issue is not in CISA KEV.