{"items":[{"id":"CVE-2026-116545","published":"2026-11-06T11:17:37.665Z","updated":"2026-11-06T15:01:29.759Z","title":"All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field","severity":"MEDIUM","score":6.4,"vendor":"plugins360","product":"All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-109209","published":"2026-10-28T02:29:59.405Z","updated":"2026-10-29T01:51:59.353Z","title":"All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC","severity":"MEDIUM","score":6.4,"vendor":"plugins360","product":"All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-109974","published":"2026-10-28T02:29:57.994Z","updated":"2026-10-29T01:51:59.778Z","title":"All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute","severity":"MEDIUM","score":6.4,"vendor":"plugins360","product":"All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2026-12123","published":"2026-07-10T05:34:04.429Z","updated":"2026-07-10T14:35:37.311Z","title":"All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter","severity":"MEDIUM","score":6.4,"vendor":"plugins360","product":"All-in-One Video Gallery","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2024-13362","published":"2026-05-01T05:29:54.148Z","updated":"2026-05-01T13:23:26.723Z","title":"Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter","severity":"MEDIUM","score":6.1,"vendor":"sebet","product":"Go Fetch Jobs (for WP Job Manager)","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-1706","published":"2026-03-04T09:24:30.422Z","updated":"2026-04-08T17:18:47.058Z","title":"All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter","severity":"MEDIUM","score":6.1,"vendor":"plugins360","product":"All-in-One Video Gallery","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2025-15516","published":"2026-01-24T08:26:33.155Z","updated":"2026-01-26T18:05:35.718Z","title":"All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update","severity":"MEDIUM","score":4.3,"vendor":"plugins360","product":"All-in-One Video Gallery","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-14947","published":"2026-01-23T17:26:06.739Z","updated":"2026-04-08T17:19:20.636Z","title":"All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion","severity":"MEDIUM","score":6.5,"vendor":"plugins360","product":"All-in-One Video Gallery","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2025-12957","published":"2026-01-16T04:44:35.026Z","updated":"2026-04-08T17:15:08.004Z","title":"All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass","severity":"HIGH","score":8.8,"vendor":"plugins360","product":"All-in-One Video Gallery","kev":false,"epss":0.0065,"kevAdded":null},{"id":"CVE-2025-12966","published":"2025-12-06T09:25:57.785Z","updated":"2025-12-08T21:26:19.403Z","title":"All-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP","severity":"HIGH","score":8.8,"vendor":"plugins360","product":"All-in-One Video Gallery","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2022-4974","published":"2024-10-16T06:43:30.014Z","updated":"2026-04-08T16:46:54.861Z","title":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","severity":"MEDIUM","score":6.3,"vendor":"dashlabsltd","product":"YASR – Yet Another Star Rating Plugin for WordPress","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2024-6629","published":"2024-07-24T06:42:23.526Z","updated":"2026-04-08T17:33:39.796Z","title":"All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode","severity":"MEDIUM","score":6.4,"vendor":"plugins360","product":"All-in-One Video Gallery","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2024-4670","published":"2024-05-15T12:46:20.118Z","updated":"2026-04-08T17:29:12.506Z","title":"All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode","severity":"HIGH","score":8.8,"vendor":"plugins360","product":"All-in-One Video Gallery","kev":false,"epss":0.00618,"kevAdded":null},{"id":"CVE-2024-4033","published":"2024-05-02T16:52:46.859Z","updated":"2026-04-08T17:28:50.007Z","title":"All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image","severity":"HIGH","score":8.8,"vendor":"plugins360","product":"All-in-One Video Gallery","kev":false,"epss":0.01558,"kevAdded":null},{"id":"CVE-2022-2633","published":"2022-09-06T17:18:59.000Z","updated":"2024-11-20T14:56:44.283Z","title":"The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found…","severity":"HIGH","score":7.5,"vendor":"plugins360","product":"All-in-One Video Gallery","kev":false,"epss":0.35707,"kevAdded":null}]}