All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos vulnerabilities

Product

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos

by plugins360 · last CVE Oct 28, 2026

CVEs

On KEV

6.4

Max CVSS

New 30D

Vulnerabilities2 In the news0 Timeline

Severity mix

Critical 0High 0Medium 2Low 0

Severity

All severities2 Critical0 High0 Medium2 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-109209 New	6.4	0%	Oct 28	All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC Affected: through 4.9.7
CVE-2026-109974 New	6.4	0%	Oct 28	All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute Affected: through 4.9.7