{"affected":[{"defaultStatus":"unaffected","product":"All-in-One Video Gallery","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.0.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118783","cwes":["CWE-79"],"description":"The All-in-One Video Gallery  WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/119477bd-1b29-4e33-9040-38cb6f0ae623/"}],"kev":null,"metrics":[],"modifiedAt":1793772028779,"publishedAt":1793772028779,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/119477bd-1b29-4e33-9040-38cb6f0ae623/"}],"remediation":[],"revision":"b8cefb29660c7633374552b5a95d0c0c43dcf0cfbbd83eaef80474acae7931cc","sources":[{"modifiedAt":1793772028779,"name":"CNA: WPScan","retrievedAt":1793776149028,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118783"}],"ssvc":null,"status":"published","title":"All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute","updatedAt":1793776149028}