CVE-2026-118629
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 31, 2026
- Updated
- Nov 1, 2026
- Reserved
- Oct 28, 2026
Description
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
All-in-One Video GalleryUnknown |
|
References
- https://wpscan.com/vulnerability/a17559f9-f2d6-434f-8dd0-db4d1d9766d2/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.