All-in-One Video Gallery, CVE-2026-118629
- CVE, Research URL
- Home page URL
- Application
- Published on
- Oct 31, 2026
- Research Description
- The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.
- Affected versions
-
max 5.0.0.
- Status
-
vulnerable