CVE-2026-118629mediumCWE-200

CVE-2026-118629: medium-severity vulnerability in All-in-One Video Gallery

All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure

Published · Updated

Follow this CVE+ Monitor All-in-One Video Gallery

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.3%
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · All-in-One Video Gallery
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — All-in-One Video Gallery

In the same product, most dangerous first.

CVE-2021-24970—All-In-One-Gallery < 2.5.0 - Admin+ Local File InclusionEPSS 5.0%CVE-2026-19075MEDIUMAll-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' ParameterEPSS 0.3%