Read the docs

plugins360

Records17All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

plugins360 records in CISA KEV

No plugins360 vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
All-in-one Video Gallery 4 records HIGH

Records

4 records in All-in-one Video Gallery · all components

TI-2022-02434 CVE-2022-2633 · GHSA-524p-6j7x-rwrc

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file…

Priority HIGH 67

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and includi…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.35707 Published 2022-09-06 No fix listed CWE-610
TI-2021-07249 CVE-2021-24970 · GHSA-c9pf-3r6r-m8r5

All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion

Priority MEDIUM 40

The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.05013 Published 2021-12-13 Fixed in 2.5.0 CWE-22
TI-2024-06147 CVE-2024-6629 · GHSA-mgvc-8vcc-rr9m

All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode

Priority LOW 28

The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versions up to, and including, 3.7.1 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00329 Published 2024-07-24 No fix listed CWE-79
Open these records in search →