Medium severity · published Oct 31, 2026
CVE-2026-118629
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure
New
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
All-in-One Video Gallery ·
before 5.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118629
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118629
exploit
https://wpscan.com/vulnerability/a17559f9-f2d6-434f-8dd0-db4d1d9766d2/
More from All-in-One Video Gallery
7.2
CVE-2021-24970
All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion
5.0
CVE-2026-19075
All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter