All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos has 15 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 15 are fixed as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 6 high. 2026 was the busiest year with 6 disclosures.

The most common weakness is Missing Authorization, behind 4 of the records (27%). Other recurring categories include Cross-Site Scripting, Unrestricted Upload Of File With Dangerous Type.

Every one of the 15 issues recorded for All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos has a vendor fix available, so running the current release closes all known holes.

13 independent researchers contributed these findings, most of them (2) reported by kr0d. All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891019.12.2017Today15.11.20217.2All-In-One-Gallery <= 2.4.9 - Admin+ Local File Inclusion CVSS 7.2 · 15.11.202104.03.20226.3Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 6.3 · 04.03.202217.08.20227.5All-in-One Video Gallery 2.5.8 - 2.6.0 - Arbitrary File Download & Server-Side Request Forgery CVSS 7.5 · 17.08.202218.07.20236.1Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get CVSS 6.1 · 18.07.202305.04.20244.3All-in-One Video Gallery <= 3.5.2 - Missing Authorization CVSS 4.3 · 05.04.202401.05.20248.8All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image CVSS 8.8 · 01.05.202414.05.20248.8All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode CVSS 8.8 · 14.05.202423.07.20246.4All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode CVSS 6.4 · 23.07.202405.12.20258.8All-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP CVSS 8.8 · 05.12.202515.01.20268.8All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass CVSS 8.8 · 15.01.202622.01.20266.5All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion CVSS 6.5 · 22.01.202623.01.20264.3All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update CVSS 4.3 · 23.01.202603.03.20266.1All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter CVSS 6.1 · 03.03.202609.07.20266.4All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter CVSS 6.4 · 09.07.202607.08.20266.4All-in-One Video Gallery <= 4.9.1 - Authenticated (Subscriber+) Server-Side Request Forgery CVSS 6.4 · 07.08.2026

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage100%
Open

0

Fixed

15

Get automatic notifications for all All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-12957

All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass

Read the full analysis

Vulnerability Records

15 records
2026-08-07 00:00CVE-2026-19075
6.4
Medium
Mohammed Abd AlrahmanYes
2026-07-09 16:59CVE-2026-12123
6.4
Medium
KoreaInfoSecYes
2026-03-03 20:24CVE-2026-1706
6.1
Medium
Muhammad Yudha - DJYes
2026-01-23 19:29CVE-2025-15516
4.3
Medium
kr0dYes
2026-01-22 00:00CVE-2025-14947
6.5
Medium
andrea bocchettiYes
2026-01-15 16:28CVE-2025-12957
8.8
High
mikemyersYes
2025-12-05 21:16CVE-2025-12966
8.8
High
kr0dYes
2024-07-23 18:08CVE-2024-6629
6.4
Medium
WebbernautYes
2024-05-14 00:00CVE-2024-4670
8.8
High
Ngô Thiên An (ancorn_)Yes
2024-05-01 00:00CVE-2024-4033
8.8
High
stealthcopterYes
Showing 1–10 of 15 reports
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos banner
Latestv4.9.3

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos

Plugins360 Labs

Author

Plugins360 Labs

4.8(135)
96/100
Last Updated
2026-08-25 (19d ago)
Active Installs
20,000+
Downloads
869,456
Requires WP
6.3+
Requires PHP
5.6.20+
Tested up to
WP 7.1
Created
2017-12-19 (9y ago)

★★★★★ Trusted by 20,000+ WordPress sites View Demo | Getting Started | Contact & Support | Home Page All-in-One Video Gallery is a video posts plugin that lets you add videos as posts and build scalable, searchable, SEO-optimized video galleries in minutes — no coding required. Whether you need a single embedded video player or a full video-sharing website like YouTube or Vimeo, this plugin covers it. Suitable for course creators, video bloggers, podcasters, businesses, and anyone embedding video on WordPress. PLAYER FEATURES A Custom HTML5 Video Player that supports MP4, WebM, OGV, HLS, MPEG-DASH, and embeddable players like YouTube, Vimeo, Dailymotion, Rumble, Facebook, Bunny Stream and more. Player Controls: play/pause buttons, timer, progress bar, duration, speed control, quality switcher, volume button, picture-in-picture button, fullscreen button, share buttons, embed button, download button, subtitles on/off, keyboard hotkeys Playback Options: autoplay, loop, muted, preload, playsinline Subtitles & Captions (WebVTT). Chapter Markers. GDPR compatibility. [+] support embed code from any third-party video sharing websites. GALLERY FEATURES Back-End A user-friendly interface to upload and manage your videos. Create unlimited categories/subcategories and tags. Ability to group videos by categories and tags. Create a featured videos group. Bulk import videos from a CSV file or folder; export all your videos in one click. Restrict video access globally or per video — allow all visitors, logged-in users only, logged-out users only, or specific user roles. 100+ settings (STILL COUNTING) that help you customize the plugin to the maximum you will need. Front-End Modern, Responsive design. Categories display options: Grid, List Sort categories by “ID”, “videos count”, “category name”, “slug” & “menu order (custom ordering)”. Videos display options: Grid. More template options are available with our premium version. Filter videos by “categories”, “tags” and “featured” meta key. Sort videos by “video posted date”, “title”, “views count”, “likes count”, “dislikes count”, “random” & “menu order (custom ordering)”. Ability to control the display of each HTML element in the gallery. Filter videos on the same page using AJAX — search by keyword, category, or tag and sort by title, date, or popularity without a page reload. Numeric Pagination for the large galleries. Likes / Dislikes. Social Sharing (Facebook, X (Twitter), LinkedIn, Pinterest, Tumblr & WhatsApp). Comments System. Dedicated search form & layout. Shortcode Builder to build the gallery shortcodes. Gutenberg Blocks to build the gallery if your website uses the modern WordPress editor. Widgets to list categories, list videos, display a single video player, and search videos. DEVELOPER OPTIONS The videos (aiovg_videos) belong to a WordPress Custom Post Type. Similarly, the categories (aiovg_categories) and tags (aiovg_tags) belong to the WordPress Custom Taxonomy. The plugin doesn’t use any custom tables and the settings are stored in the WP_Options table using the WordPress SETTINGS API. In short, the plugin has been developed completely using the WordPress CORE features. So, if you’re a WordPress developer, you can customize/extend the plugin as you like using the WordPress hooks system easily. Similarly, the front-end gallery layouts added by our plugin can be customized by developing or overriding our existing templates. Please check for a detailed documentation on this. [+] PREMIUM FEATURES Gallery Templates: Popup, Inline, Slider, Playlist, Compact (Modern) Auto import videos from YouTube & Vimeo websites. Video SEO: Schema.org Markup (via JSON-LD) Auto Thumbnail Generator Custom Logo & Branding Custom Context Menu Front-end User Submission User Playlists / Favorites VAST / VPAID Ads TRANSLATION READY Do you speak another language? Want to contribute in a meaningful way to All-in-One Video Gallery? There’s no better way than to help us translate the plugin. This plugin is translation ready and you can translate to your language easily. Once finished, please reach out to us here to get your language file included in the core. Spanish translation partner – Blarlo LATEST ADDITION Trailers & Teasers! Display a trailer clip to non-access users instead of the locked screen — great for driving upgrades or sign-ups. Email & Lead Capture! Show an email collection form over your video to capture leads before, during, or after playback. SUPPORT AND DOCUMENTATION We do have documentation on the plugin. Still, Having Issues? We are just an email away. Please write to us describing your issue using the “Contact” form available under our plugin’s menu. You should receive a reply within 24 hours (except Sunday). Also, we answer all support requests on the WordPress.org support forum.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C