CVE-2026-109974 in All-in-One Video Gallery Plugin
Summary
by MITRE • 10/28/2026
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The All-in-One Video Gallery plugin for WordPress presents a significant security risk due to a stored cross-site scripting vulnerability affecting versions up to 4.9.7. This flaw stems from insufficient input sanitization and output escaping mechanisms within the application code, specifically concerning the more_link parameter. The nature of this vulnerability allows malicious actors to inject arbitrary web scripts into database-stored content, which are then rendered in HTML pages without proper validation or encoding by the browser.
The technical root cause lies in the failure to properly sanitize user-supplied data before storage and to escape it during output generation. When an authenticated user with contributor-level access or higher interacts with the plugin interface, they can supply a crafted value for the more_link parameter that contains executable JavaScript code. Because WordPress typically requires authentication for content modification, this vulnerability is restricted to users who have already gained some level of trust within the system environment. However, once injected, the malicious script becomes persistent in the database and executes automatically whenever any user views the affected page or post containing the compromised link.
From an operational perspective, this stored cross-site scripting attack vector enables attackers to perform a wide range of harmful actions against victims who view the infected content. These actions can include stealing session cookies, hijacking administrative sessions if high-privilege users are targeted, defacing websites by altering displayed content, or redirecting users to malicious phishing sites designed to harvest credentials. The persistent nature of stored XSS means that the impact is not limited to a single interaction but continues to affect every visitor until the vulnerable code is removed from the database, thereby amplifying the potential damage significantly compared to reflected variants.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as cross-site scripting. In terms of offensive security frameworks such as MITRE ATT&CK for Enterprise and Mobile, this behavior corresponds to techniques involving client-side injection attacks where adversaries leverage trusted applications to execute malicious scripts in the context of a victim's browser session. The attack path typically involves initial access through valid credentials followed by persistence via data manipulation within the application layer.
To mitigate this risk, administrators should immediately update the All-in-One Video Gallery plugin to version 4.9.8 or later where these sanitization and escaping issues have been addressed. In environments where immediate patching is not feasible, implementing a Web Application Firewall can provide an additional layer of defense by filtering out malicious payloads in HTTP requests before they reach the application logic. Furthermore, enforcing strict least-privilege principles for user accounts ensures that only essential personnel have contributor-level or higher access rights, thereby reducing the attack surface available to potential intruders who might compromise lower-privileged accounts first. Regular security audits and code reviews focusing on input validation and output encoding practices are also recommended to prevent similar vulnerabilities in future updates.