CVE-2026-118629

All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.

Affected

All-in-One Video Gallery

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.25% chance of exploitation in the next 30 days, 17th percentile

Published

2026-10-31

Updated

2026-11-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a17559f9-f2d6-434f-8dd0-db4d1d9766d2/find archive

CVE references

• https://wpscan.com/vulnerability/a17559f9-f2d6-434f-8dd0-db4d1d9766d2REFERENCE

References

• CVE Record
• NVD entry