All-in-One Video Gallery vulnerabilities | LiveThreat CVE Feed

Product

All-in-One Video Gallery

by plugins360 · last CVE Jul 10, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities12 In the news0 Timeline

Severity mix

Critical 0High 7Medium 5Low 0

Severity

All severities12 Critical0 High7 Medium5 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add All-in-One Video Gallery to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-12957	8.8	1%	Jan 16	All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass Affected: through 4.5.7
CVE-2025-12966	8.8	1%	Dec 6	All-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP Affected: 4.5.4 through 4.5.7
CVE-2024-31248	8.8	0%	Jun 9	WordPress All-in-One Video Gallery plugin <= 3.5.2 - Broken Access Control vulnerability Affected: before 3.6.0
CVE-2024-4670	8.8	1%	May 15	All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode Affected: through 3.6.5
CVE-2024-4033	8.8	2%	May 2	All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image Affected: through 3.6.4
CVE-2022-2633	8.2	36%	Sep 6	The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the… Affected: 2.5.8 through 2.6.0
CVE-2021-24970	7.2	5%	Dec 13	All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion Affected: before 2.5.0
CVE-2025-14947	6.5	0%	Jan 23	All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion Affected: through 4.6.4
CVE-2026-12123	6.4	0%	Jul 10	All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter Affected: through 4.8.5
CVE-2026-1706	6.1	0%	Mar 4	All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter Affected: through 4.7.1
CVE-2024-6629	5.4	0%	Jul 24	All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode Affected: through 3.7.1
CVE-2025-15516	4.3	0%	Jan 24	All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update Affected: 4.1.0 through 4.6.4