https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T21:29:32.347067+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-120408 CVE-2026-120408 — All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta 2026-11-13T21:29:32.349037+00:00

Affected: Unknown All-in-One Video Gallery

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.