Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: plugins360 Component: All-in-one Video Gallery Clear all filters
TI-2024-06147 CVE-2024-6629 · GHSA-mgvc-8vcc-rr9m

All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode

Priority LOW 28

The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versions up to, and including, 3.7.1 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00329 Published 2024-07-24 No fix listed CWE-79
TI-2022-02434 CVE-2022-2633 · GHSA-524p-6j7x-rwrc

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file…

Priority HIGH 67

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and includi…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.35707 Published 2022-09-06 No fix listed CWE-610
TI-2021-07249 CVE-2021-24970 · GHSA-c9pf-3r6r-m8r5

All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion

Priority MEDIUM 40

The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.05013 Published 2021-12-13 Fixed in 2.5.0 CWE-22