Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 12:22:19 +0000 CVE-2026-109209 — All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta v… https://db.gcve.eu/vuln/cve-2026-109209 <p><strong>Affected:</strong> plugins360 All-in-One Video Gallery – Video Player &amp; Galleries for YouTube, Vimeo &amp; Self-Hosted Videos</p> <p>The All-in-One Video Gallery – Video Player &amp; Galleries for YouTube, Vimeo &amp; Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;custom_fields[embedcode]&#39; parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is possible because the save_meta_data() handler returns early when $_POST[&#39;post_type&#39;] is absent — a condition always true during XML-RPC requests — and the plugin unconditionally grants Subscribers the publish_aiovg_videos capability, making this exploitable by any authenticated user via a single wp.newPost XML-RPC call.</p> <p><strong>Affected:</strong> plugins360 All-in-One Video Gallery – Video Player &amp; Galleries for YouTube, Vimeo &amp; Self-Hosted Videos</p> <p>The All-in-One Video Gallery – Video Player &amp; Galleries for YouTube, Vimeo &amp; Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;custom_fields[embedcode]&#39; parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is possible because the save_meta_data() handler returns early when $_POST[&#39;post_type&#39;] is absent — a condition always true during XML-RPC requests — and the plugin unconditionally grants Subscribers the publish_aiovg_videos capability, making this exploitable by any authenticated user via a single wp.newPost XML-RPC call.</p> https://db.gcve.eu/vuln/cve-2026-109209