Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 21:28:18 +0000 CVE-2026-120408 — All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta https://db.gcve.eu/vuln/cve-2026-120408 <p><strong>Affected:</strong> Unknown All-in-One Video Gallery</p> <p>The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video&#39;s stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.</p> <p><strong>Affected:</strong> Unknown All-in-One Video Gallery</p> <p>The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video&#39;s stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.</p> https://db.gcve.eu/vuln/cve-2026-120408