{"affected":[{"defaultStatus":"unaffected","product":"All-in-One Video Gallery","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.1.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-120408","cwes":["CWE-79"],"description":"The All-in-One Video Gallery  WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/ddbbaa38-e9cc-416f-8b3f-72d721f82dc3/"}],"kev":null,"metrics":[],"modifiedAt":1793944826378,"publishedAt":1793944826378,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/ddbbaa38-e9cc-416f-8b3f-72d721f82dc3/"}],"remediation":[],"revision":"f41328f4c8993ddc9f31201c2ed73de1e88d0db002e92bee7ab0227738e8dfd3","sources":[{"modifiedAt":1793944826378,"name":"CNA: WPScan","retrievedAt":1793945329303,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120408"}],"ssvc":null,"status":"published","title":"All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta","updatedAt":1793945329303}