All In One Image Viewer – Zoom, Magnify, Maps & Rotation
All In One Image Viewer – Zoom, Magnify, Maps & Rotation has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Server-Side Request Forgery (SSRF), behind 1 of the records (100%).
The one issue recorded for All In One Image Viewer – Zoom, Magnify, Maps & Rotation has a vendor fix available, so running the current release closes it.
All of these findings were reported by Athiwat Tiprasaharn (Jitlada). All In One Image Viewer – Zoom, Magnify, Maps & Rotation is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2026-1294All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint
Read the full analysisVulnerability Records

All In One Image Viewer – Zoom, Magnify, Maps & Rotation
Author
bPlugins
All In One Image Viewer is a completely free WordPress Image Viewer Plugin designed for Gutenberg. It helps you create interactive image experiences using Image Zoom, Image Magnifier, Image Map, and Image Rotation (360° panorama). Whether you run an eCommerce store, photography portfolio, real estate website, educational platform, art galleries, media website, agency, or business website, this plugin makes it easy to display images more engagingly and interactively. Every feature is included for free. There is no pro version, no locked styles, and no upsells. Image Viewer | Documentation | Support Key Features Four Image Viewer Modes: Choose from Zoom, Magnify, Map, and Pano/Rotation viewer modes to display images in the most suitable way for your content. Zoom Viewer with Full Controls: Enable or disable Pan, Zoom, X-Axis, and Y-Axis, set Start Scale, and control Zoom Step for precise image inspection. Magnify Viewer Options: Highlight specific image areas using magnification with adjustable speed and timeout settings. Interactive Image Map: Add multiple map items on an image with full control over: Link URL, Link target, Title, Width & height, Top & left positioning, Drag & drop placement for each map item. Rotation Viewer: Rotate 360° panorama images smoothly with options to: Set custom width and height, Enable or disable auto-rotation, Control auto-rotate speed, Hide or show rotation controls. Shortcode & PHP Support: Build a viewer once and embed it anywhere with [bpivb id=123] or do_shortcode(). Responsive & Touch Friendly : Works smoothly on desktop, tablet, and mobile devices, including touch gestures. Unlimited Usage: Use the Image Viewer block unlimited times across posts and pages. Theme Compatibility: Fully compatible with all standard WordPress themes. Lightweight & Performance Optimized: Clean and optimized code ensures fast loading and smooth interaction. Why Choose All In One Image Viewer? If you are looking for a complete Image Viewer Plugin for WordPress, this plugin provides multiple image interaction tools in a single Gutenberg block, allowing website owners to create engaging, responsive, and interactive image experiences without writing code. Whether you need an Image Zoom Plugin, Image Magnifier, Interactive Image Map, or a 360° panorama viewer, this plugin provides everything in one free solution. With All In One Image Viewer, you can: ✔ Create interactive Image Zoom effects ✔ Add Image Magnifier functionality ✔ Build clickable Image Maps ✔ Rotate 360° panorama images interactively ✔ Improve image engagement and user interaction ✔ Enhance WooCommerce product image presentation ✔ Display professional photography portfolios Why is All In One Image Viewer such a game-changer? Configure — You can easily modify the Image Viewer plugin to suit your needs. Your work will go more quickly thanks to the Image Viewer plugin’s features and simplicity of use. There are four different viewer types — zoom, magnify, map, and pano/rotation. Customer Service — Our staff is always available to assist you. It’s easy for users to ask questions and get quick answers. Updates — With frequent updates, we bring the functionality and performance of the plugin up to date. Upgrading to newer versions is also easy, ensuring uninterrupted service. How to use First, install the All In One Image Viewer plugin. Add the Image viewer block from the block category called “Widgets” in the Gutenberg editor. You can change block settings from the right-side settings sidebar. Enjoy! For installation help, click on the Installation Tab External Services This plugin connects to the following external services from the admin dashboard: bPlugins Opt-In API Service URL: https://api.bplugins.com Purpose: Receives the plugin opt-in consent submission when a user explicitly opts in from the admin dashboard. Data Sent: Only after explicit user opt-in — user name, email, site URL, WP/PHP version, plugin version. Nothing is sent unless you opt in. Terms of Service: https://bplugins.com/terms-of-service/ Privacy Policy: https://bplugins.com/privacy-policy/ Freemius (wp.freemius.com) Endpoint: https://wp.freemius.com/ Used for: Processing plugin opt-in consent form submissions. Data sent: Only after explicit user opt-in — user name, email, site URL, WP/PHP version, plugin version. Terms of Service: https://freemius.com/terms/ Privacy Policy: https://freemius.com/privacy/ WordPress.org Plugins API Service URL: https://api.wordpress.org Purpose: The admin dashboard queries the official WordPress.org Plugins API to retrieve and display a curated list of other plugins by the same author (“Our Plugins” section). Data Sent: Plugin slugs and author name; no personal or site data is collected. Terms of Service: https://wordpress.com/tos/ Privacy Policy: https://wordpress.org/about/privacy/ Third-Party Libraries Source / GitHub: Bpl-Tools GitHub License: GPL-2.0-or-later Purpose: Shared utility library providing admin dashboard components and common Gutenberg editor controls. External Services: The library may connect to bPlugins, WordPress.org, and Freemius services for product data. See full details: https://github.com/bPlugins/bpl-tools#external-requests–why-they-are-made
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C