Cross-site Scripting

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video ShortcodeCVE-2024-6629plugins360 · CVSS 6.4 · 0.3% likely

   CWE-79

2. All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' ParameterCVE-2026-1706plugins360 · CVSS 6.1 · 0.3% likely

   CWE-79

3. All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' FieldCVE-2026-116545plugins360 · CVSS 6.4 · 0.3% likely

   CWE-79

4. All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPCCVE-2026-109209plugins360 · CVSS 6.4 · 0.2% likely

   CWE-79

5. All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode AttributeCVE-2026-109974plugins360 · CVSS 6.4 · 0.2% likely

   CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.