Description

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'custom_fields[].value.label (for key='track')' parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site's Player Library option to be configured as Plyr/Vidstack (aiovg_player_settings[player]='vidstack') rather than the Video.js default, as the DOM innerHTML sink exists only in the Plyr/Vidstack template path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-11-06T12:17:17.000Z",
  "pubdate": "2026-11-06T12:17:17.000Z",
  "executiveSummary": "The All-in-One Video Gallery plugin for WordPress is susceptible to a Stored DOM-based Cross-Site Scripting (XSS) vulnerability, identified in versions up to and including 5.0.0.\nThe flaw originates from improper input sanitization and output escaping within the 'custom_fields[].value.label' parameter, specifically when the 'track' key is utilized.\nSuccessful exploitation allows an authenticated attacker with subscriber-level privileges or higher to inject arbitrary JavaScript, which executes in the context of a victim's browser when they access the affected page.\nThe vulnerability is conditionally triggered based on the site's configuration; it requires the Player Library option to be set to 'Plyr/Vidstack' (aiovg_player_settings[player]='vidstack'), as the insecure DOM innerHTML sink is exclusive to that specific template path.\nThis vulnerability poses a significant risk to site integrity and user session security, as it facilitates unauthorized script execution, potentially leading to session hijacking, defacement, or redirection to malicious domains.",
  "technicalDetails": "The vulnerability is a Stored DOM-based XSS flaw affecting the All-in-One Video Gallery plugin. The root cause is the inadequate sanitization of user-supplied data in the 'custom_fields[].value.label' parameter when processed for 'track' key entries.\nIn the plugin's code architecture, when the Player Library is set to 'Plyr/Vidstack', the template handling logic utilizes a dangerous DOM sink, specifically an assignment to 'innerHTML', without applying necessary sanitization or character encoding.\nAn authenticated attacker possessing at least subscriber-level access can manipulate the 'custom_fields' payload during video creation or editing. By injecting a malicious script into the 'label' field associated with a 'track' entry, the payload is stored persistently in the WordPress database.\nThe attack flow follows these steps: First, the attacker crafts a malicious request containing a script payload within the 'custom_fields[].value.label' parameter. Second, the server-side logic processes this input and stores it within the gallery's settings or associated metadata without stripping HTML tags or executing proper escaping. Third, when a victim navigates to a page where the video gallery is rendered, the application fetches the stored malicious string. Finally, the Plyr/Vidstack template component retrieves this string and injects it directly into the DOM using 'innerHTML', causing the browser to parse and execute the attacker's JavaScript code.\nBecause the execution happens via the DOM innerHTML sink, the script runs within the security context of the victim's session on the affected WordPress site. This allows for various post-exploitation activities, including the theft of administrative session cookies, unauthorized administrative actions performed on behalf of the victim, or the injection of persistent malicious content into the site's frontend.\nThe dependency on the 'vidstack' configuration is critical; if the plugin is set to the default 'Video.js' library, the vulnerable code path is not rendered, effectively neutralizing the attack surface for that specific configuration. However, for installations using the Plyr/Vidstack library, the vulnerability is reachable and fully exploitable, necessitating immediate security intervention."
}