Unrated
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication...
CVE-2026-118629
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| CVE | All-in-One Video Gallery |
< 5.0.0 |
5.0.0 |
Original description The description as published by the source.
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web contact@wpscan.com
- web nvd.nist.gov
- web wpscan.com
- web github.com