5.3
MediumCVSS 3.1 · from CISA
CVE-2026-118629
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure
All-in-One Video Gallery · Information exposure · CWE-200AffectedAll-in-One Video Gallery
FixUpdate to 5.0.0 or newer
PublishedOct 31, 06:00 · WPScan
Scored5.3 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Description
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.
From WPScan
Affected and fixed versions
ProductAffectedFixed inAll-in-One Video Gallerybefore 5.0.05.0.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known