CVE-2026-120408

— UNSCORED

Published 2026-11-06 · Updated 2026-11-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.

All references

https://wpscan.com/vulnerability/ddbbaa38-e9cc-416f-8b3f-72d721f82dc3/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.