CVE-2026-119259mediumCWE-862

CVE-2026-119259: fallo de gravedad media en All-in-One Video Gallery

All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write

Publicada el

Seguir esta CVE+ Monitorear All-in-One Video Gallery

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 5.3epss 0.2%
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
Unknown · All-in-One Video Gallery
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — All-in-One Video Gallery

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-24970—All-In-One-Gallery < 2.5.0 - Admin+ Local File InclusionEPSS 5.0%CVE-2026-19075MEDIUMAll-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' ParameterEPSS 0.3%CVE-2026-118629MEDIUMAll-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video DisclosureEPSS 0.3%CVE-2026-118783MEDIUMAll-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode AttributeEPSS 0.2%CVE-2026-120408HIGHAll-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post MetaEPSS 0.2%CVE-2026-120409MEDIUMAll-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via Player Page and Download HandlerEPSS 0.1%