All-in-One Video Gallery
| Version / range | Status | Type |
|---|---|---|
| 0 to before 5.0.0 | affected | semver |
Threat intelligence dashboard
CVE-2026-118629Unrated
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.
Risk score
—
CVSS unavailable
- Vendor
- Not available
- Product
- All-in-One Video Gallery
- CWE
- CWE-200
- Published
- Oct 31, 2026
- Updated
- Oct 31, 2026
- CISA KEV
- Not flagged
Affected products and versions
Technical metrics
No CVSS metrics were provided.