Plugins360 - vulnerabilities (CVEs)
16 CVEs in 4 products, 2 in the last 30 days, newest from 2026-10-28.
Products
- All-in-one Video Gallery - 11 CVEs
- All-in-one Video Gallery Video Player Galleries For Youtube - 2 CVEs
- Automatic Youtube Gallery - 2 CVEs
- Vimeo Self-hosted Videos - 2 CVEs
Newest CVEs of Plugins360
- CVE-2026-109209 - CVSS 6.4 (medium), 2026-10-28: The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site…
- CVE-2026-109974 - CVSS 6.4 (medium), 2026-10-28: The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site…
- CVE-2026-12123 - CVSS 6.4 (medium), 2026-07-10: The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl'…
- CVE-2024-13362 - CVSS 6.1 (medium), 2026-05-01: Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient…
- CVE-2026-1706 - CVSS 6.1 (medium), 2026-03-04: The All-in-One Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vi' parameter in all versions up to, and including,…
- CVE-2025-15516 - CVSS 4.3 (medium), 2026-01-24: The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the…
- CVE-2025-14947 - CVSS 6.5 (medium), 2026-01-23: The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the…
- CVE-2025-12957 - CVSS 8.8 (high), 2026-01-16: The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.5.7. This is due to…
- CVE-2025-12966 - CVSS 8.8 (high), 2025-12-06: The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the…
- CVE-2022-4974 - CVSS 6.3 (medium), 2024-10-16: The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to…
- CVE-2024-6629 - CVSS 6.4 (medium), 2024-07-24: The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versions up to, and…
- CVE-2024-31248 - CVSS 8.8 (high), 2024-06-09: Missing Authorization vulnerability in Team Plugins360 All-in-One Video Gallery.This issue affects All-in-One Video Gallery: from n/a through 3.5.2.
- CVE-2024-4670 - CVSS 8.8 (high), 2024-05-15: The All-in-One Video Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.5 via the aiovg_search_form…
- CVE-2024-4033 - CVSS 8.8 (high), 2024-05-02: The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the…
- CVE-2022-2633 - CVSS 8.2 (high), 2022-09-06: The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found…
- CVE-2021-24970 - CVSS 7.2 (high), 2021-12-13: The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the…
