CVE-2022-2633

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-610

Affected software

Vendor	Product	Versions
plugins360	All-in-One Video Gallery	>= 2.5.8, <= 2.6.0

References

https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/video.php#L227Patch, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2768384/all-in-one-video-gallery/trunk/public/video.phpPatch, Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2744708%40all-in-one-video-gallery&new=2744708%40all-in-one-video-gallery&sfp_email=&sfph_mail=Patch, Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/83b0534e-1b8d-46a8-9698-e7ca73e5ab57?source=cve
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2633Third Party Advisory
https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/video.php#L227Patch, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2768384/all-in-one-video-gallery/trunk/public/video.phpPatch, Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2744708%40all-in-one-video-gallery&new=2744708%40all-in-one-video-gallery&sfp_email=&sfph_mail=Patch, Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/83b0534e-1b8d-46a8-9698-e7ca73e5ab57?source=cve
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2633Third Party Advisory

Timeline

Published: Sep 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-263307.5Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in CVE-2022-263316.1Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in CVE-2022-263325.4Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.CVE-2022-263347.5A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X CVE-2022-263357.5A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X CVE-2022-263365.5A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is use CVE-2022-263377.8Trend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to an Uncontrolled Search Path Element vulnerab CVE-2022-263389.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerPageP_KID.ashx. Thi CVE-2022-26349.8An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web CVE-2022-263404.9On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior CVE-2022-263418.8Insufficiently protected credentials in software in Intel(R) AMT SDK before version 16.0.4.1, Intel(R) EMA before version 1.7.1 and Intel(R)CVE-2022-263429.8A buffer overflow vulnerability exists in the confsrv ucloud_set_node_location functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A s