Login Request a demo
High severity · published Jan 16, 2026
CVE-2025-12957
All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.5.7. This is due to insufficient file type validation detecting VTT files, allowing double extension files to bypass sanitization while being accepted as a valid VTT file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
All-in-One Video Gallery · plugins360
through 4.5.7 · source: vendor
Affected product
AV
All-in-One Video Gallery
plugins360
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12957
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12957
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3405593/all-in-one-video-gallery
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/ad2e1d91-03bd-4e47-b679-81c42414238b?source=cve
More from All-in-One Video Gallery
8.8
CVE-2025-12966
All-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP
8.8
CVE-2024-31248
WordPress All-in-One Video Gallery plugin <= 3.5.2 - Broken Access Control vulnerability
8.8
CVE-2024-4670
All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode
8.8
CVE-2024-4033
All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image
8.2
CVE-2022-2633
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the…