Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

plugins360 vulnerabilities

15 published CVEs name plugins360 among the affected products.

Atom feed of new CVEs

Newest CVEs

  • CVE-2026-116545

    All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field

    plugins360 · All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos

    Medium6.4
  • CVE-2026-109209

    All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC

    plugins360 · All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos

    Medium6.4
  • CVE-2026-109974

    All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute

    plugins360 · All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos

    Medium6.4
  • CVE-2026-12123

    All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter

    plugins360 · All-in-One Video Gallery

    Medium6.4
  • CVE-2024-13362

    Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

    sebet · Go Fetch Jobs (for WP Job Manager)

    Medium6.1
  • CVE-2026-1706

    All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter

    plugins360 · All-in-One Video Gallery

    Medium6.1
  • CVE-2025-15516

    All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update

    plugins360 · All-in-One Video Gallery

    Medium4.3
  • CVE-2025-14947

    All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion

    plugins360 · All-in-One Video Gallery

    Medium6.5
  • CVE-2025-12957

    All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass

    plugins360 · All-in-One Video Gallery

    High8.8
  • CVE-2025-12966

    All-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP

    plugins360 · All-in-One Video Gallery

    High8.8
All 15 in the list