All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos has 15 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 15 are fixed as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 6 high. 2026 was the busiest year with 6 disclosures.
The most common weakness is Missing Authorization, behind 4 of the records (27%). Other recurring categories include Cross-Site Scripting, Unrestricted Upload Of File With Dangerous Type.
Every one of the 15 issues recorded for All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos has a vendor fix available, so running the current release closes all known holes.
13 independent researchers contributed these findings, most of them (2) reported by kr0d. All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-12957All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass
Read the full analysisVulnerability Records

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
Author
Plugins360 Labs
★★★★★ Trusted by 20,000+ WordPress sites View Demo | Getting Started | Contact & Support | Home Page All-in-One Video Gallery is a video posts plugin that lets you add videos as posts and build scalable, searchable, SEO-optimized video galleries in minutes — no coding required. Whether you need a single embedded video player or a full video-sharing website like YouTube or Vimeo, this plugin covers it. Suitable for course creators, video bloggers, podcasters, businesses, and anyone embedding video on WordPress. PLAYER FEATURES A Custom HTML5 Video Player that supports MP4, WebM, OGV, HLS, MPEG-DASH, and embeddable players like YouTube, Vimeo, Dailymotion, Rumble, Facebook, Bunny Stream and more. Player Controls: play/pause buttons, timer, progress bar, duration, speed control, quality switcher, volume button, picture-in-picture button, fullscreen button, share buttons, embed button, download button, subtitles on/off, keyboard hotkeys Playback Options: autoplay, loop, muted, preload, playsinline Subtitles & Captions (WebVTT). Chapter Markers. GDPR compatibility. [+] support embed code from any third-party video sharing websites. GALLERY FEATURES Back-End A user-friendly interface to upload and manage your videos. Create unlimited categories/subcategories and tags. Ability to group videos by categories and tags. Create a featured videos group. Bulk import videos from a CSV file or folder; export all your videos in one click. Restrict video access globally or per video — allow all visitors, logged-in users only, logged-out users only, or specific user roles. 100+ settings (STILL COUNTING) that help you customize the plugin to the maximum you will need. Front-End Modern, Responsive design. Categories display options: Grid, List Sort categories by “ID”, “videos count”, “category name”, “slug” & “menu order (custom ordering)”. Videos display options: Grid. More template options are available with our premium version. Filter videos by “categories”, “tags” and “featured” meta key. Sort videos by “video posted date”, “title”, “views count”, “likes count”, “dislikes count”, “random” & “menu order (custom ordering)”. Ability to control the display of each HTML element in the gallery. Filter videos on the same page using AJAX — search by keyword, category, or tag and sort by title, date, or popularity without a page reload. Numeric Pagination for the large galleries. Likes / Dislikes. Social Sharing (Facebook, X (Twitter), LinkedIn, Pinterest, Tumblr & WhatsApp). Comments System. Dedicated search form & layout. Shortcode Builder to build the gallery shortcodes. Gutenberg Blocks to build the gallery if your website uses the modern WordPress editor. Widgets to list categories, list videos, display a single video player, and search videos. DEVELOPER OPTIONS The videos (aiovg_videos) belong to a WordPress Custom Post Type. Similarly, the categories (aiovg_categories) and tags (aiovg_tags) belong to the WordPress Custom Taxonomy. The plugin doesn’t use any custom tables and the settings are stored in the WP_Options table using the WordPress SETTINGS API. In short, the plugin has been developed completely using the WordPress CORE features. So, if you’re a WordPress developer, you can customize/extend the plugin as you like using the WordPress hooks system easily. Similarly, the front-end gallery layouts added by our plugin can be customized by developing or overriding our existing templates. Please check for a detailed documentation on this. [+] PREMIUM FEATURES Gallery Templates: Popup, Inline, Slider, Playlist, Compact (Modern) Auto import videos from YouTube & Vimeo websites. Video SEO: Schema.org Markup (via JSON-LD) Auto Thumbnail Generator Custom Logo & Branding Custom Context Menu Front-end User Submission User Playlists / Favorites VAST / VPAID Ads TRANSLATION READY Do you speak another language? Want to contribute in a meaningful way to All-in-One Video Gallery? There’s no better way than to help us translate the plugin. This plugin is translation ready and you can translate to your language easily. Once finished, please reach out to us here to get your language file included in the core. Spanish translation partner – Blarlo LATEST ADDITION Trailers & Teasers! Display a trailer clip to non-access users instead of the locked screen — great for driving upgrades or sign-ups. Email & Lead Capture! Show an email collection form over your video to capture leads before, during, or after playback. SUPPORT AND DOCUMENTATION We do have documentation on the plugin. Still, Having Issues? We are just an email away. Please write to us describing your issue using the “Contact” form available under our plugin’s menu. You should receive a reply within 24 hours (except Sunday). Also, we answer all support requests on the WordPress.org support forum.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C