CVE-2026-120409
All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via Player Page and Download Handler
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.
| Vendor | unknown |
| Product | all-in-one video gallery |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown all-in-one video gallery
Be the first to know when new medium vulnerabilities affecting unknown all-in-one video gallery are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / All-in-One Video Gallery
0 < 5.1.1
References
Credits
Karthik Ramakrishnan WPScan