CVE-2026-118783

MediumCVSS 6.8/10Last modified Nov 4, 2026

Description

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownAll-in-One Video Gallery< 5.0.0

References

Timeline

Published
Nov 4, 2026
Last modified
Nov 4, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1187846.4The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a combCVE-2026-1187856.7Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples), affectiCVE-2026-1187866.8Improper input validation in non-secure-callable (NSC) veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example (multicore_exCVE-2026-118798.5MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading malicious DLLs from a teCVE-2026-1187907.2Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unautCVE-2026-1187917.2The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages toCVE-2026-1187926.1Default credentials permit access through AcuXDBC.CVE-2026-1187955.9Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with daCVE-2026-1187984.4Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, areCVE-2026-11889.8In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor featurCVE-2026-118803.1The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, alCVE-2026-1188006.4The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable t
CVE-2026-118783: Medium severity, CVSS 6.8 | Vulnix