Description

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-11-06T06:16:41.790Z",
  "pubdate": "2026-11-06T06:16:41.790Z",
  "executiveSummary": "The All-in-One Video Gallery WordPress plugin, specifically versions prior to 5.1.0, contains a critical Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from improper input sanitization and output escaping of video thumbnail URLs.\nThe vulnerability allows authenticated users with low-level privileges, such as Subscribers, to inject arbitrary JavaScript payloads into the administrative backend. When an administrator navigates to the plugin's video management interface, the malicious script is executed within the context of their session.\nThe impact of this vulnerability is significant, as it enables attackers to perform unauthorized actions on behalf of the administrator, potentially leading to full site compromise, account takeover, session hijacking, or the distribution of malicious content. Because the payload is stored within the database, the attack is persistent and triggers automatically whenever the admin views the list of videos. This vulnerability highlights the necessity of strict input validation and context-aware output encoding, particularly for administrative interfaces accessed by lower-privileged users.",
  "technicalDetails": "The vulnerability is a classic Stored XSS flaw stemming from insufficient security controls during the handling of user-supplied thumbnail URL metadata within the All-in-One Video Gallery plugin. The root cause resides in two primary failures: the lack of robust input sanitization when data is written to the database, and the absence of output escaping when that data is rendered in the administrator's dashboard.\nIn the affected versions (prior to 5.1.0), the plugin fails to enforce strict validation on the thumbnail URL field. An attacker authenticated as a Subscriber can manipulate the video creation or editing process to supply a crafted URL string containing a malicious JavaScript payload, such as '<script>alert(document.cookie)</script>' or more sophisticated remote script inclusions. Because the input mechanism does not strip these tags or sanitize the attribute context, the payload is committed directly to the WordPress database.\nThe exploitation flow begins when an attacker saves the malicious thumbnail URL. Subsequently, when an administrator accesses the plugin's administrative video list, the plugin retrieves the stored record and outputs the thumbnail URL directly into the HTML document object model (DOM) without proper escaping. The browser interprets the injected string as executable script rather than a benign URL attribute.\nThe execution context is the administrative dashboard, which grants the script high-level permissions within the WordPress environment. An attacker can leverage this execution to perform various malicious activities, including modifying site settings, creating new administrative accounts, or capturing sensitive session tokens and cookies. The persistence of the payload ensures that the attack remains effective across subsequent administrative logins until the malicious record is manually removed or the plugin is patched.\nThe vulnerability is particularly dangerous because the attack vector bypasses the traditional assumption that only administrators interact with sensitive plugin management interfaces. By allowing Subscribers to influence data that is eventually rendered for administrative users, the plugin fails to maintain the necessary security boundary between user roles, effectively escalating the privileges of the Subscriber to that of the site administrator upon successful execution of the payload."
}