PL
Vendor
plugins360
14
CVEs
0
On KEV
2
New 30D
Products
AV6.4
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
plugins360
2 CVEs0 on KEV2 new
AV8.8
All-in-One Video Gallery
plugins360
12 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109209 New | AV All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugins360 | 6.4 | Oct 28 | All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC |
| CVE-2026-109974 New | AV All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugins360 | 6.4 | Oct 28 | All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute |
| CVE-2026-12123 | AV All-in-One Video Gallery plugins360 | 6.4 | Jul 10 | All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter |
| CVE-2026-1706 | AV All-in-One Video Gallery plugins360 | 6.1 | Mar 4 | All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter |
| CVE-2025-15516 | AV All-in-One Video Gallery plugins360 | 4.3 | Jan 24 | All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update |
| CVE-2025-14947 | AV All-in-One Video Gallery plugins360 | 6.5 | Jan 23 | All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion |
| CVE-2025-12957 | AV All-in-One Video Gallery plugins360 | 8.8 | Jan 16 | All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass |
| CVE-2025-12966 | AV All-in-One Video Gallery plugins360 | 8.8 | Dec 6 | All-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP |
| CVE-2024-6629 | AV All-in-One Video Gallery plugins360 | 5.4 | Jul 24 | All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode |
| CVE-2024-31248 | AV All-in-one Video Gallery Plugins360 | 8.8 | Jun 9 | WordPress All-in-One Video Gallery plugin <= 3.5.2 - Broken Access Control vulnerability |
| CVE-2024-4670 | AV All-in-One Video Gallery plugins360 | 8.8 | May 15 | All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode |
| CVE-2024-4033 | AV All-in-One Video Gallery plugins360 | 8.8 | May 2 | All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image |
| CVE-2022-2633 | AV All-in-One Video Gallery plugins360 | 8.2 | Sep 6 | The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the… |
| CVE-2021-24970 | AV All-in-one Video Gallery Plugins360 | 7.2 | Dec 13 | All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion |