Plugins360 vulnerabilities

Products

• All-in-one Video Gallery 16
• All-in-one Video Gallery 5
• Automatic Youtube Gallery 3
• All-in-one Video Gallery – Video Player & Galleries For Youtube, Vimeo & Self-hosted Videos 2

Newest

• plugins360 all-in-one video gallery All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure CVE-2026-118629 5.3 MediumOctober 31, 2026
• plugins360 all-in-one video gallery – video player & galleries for youtube, vimeo & self-hosted videos All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC CVE-2026-109209 6.4 MediumOctober 28, 2026
• plugins360 all-in-one video gallery – video player & galleries for youtube, vimeo & self-hosted videos All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute CVE-2026-109974 6.4 MediumOctober 28, 2026
• plugins360 all-in-one video gallery WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability CVE-2026-114693 6.5 MediumOctober 24, 2026
• plugins360 all-in-one video gallery All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter CVE-2026-19075 5.0 MediumAugust 10, 2026
• plugins360 all-in-one video gallery All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter CVE-2026-12123 6.4 MediumJuly 10, 2026
• 100plugins open user map, 5starplugins dynamic copyright year, easy age verify +128 more +130 more Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVE-2024-13362 6.1 MediumMay 1, 2026
• plugins360 all-in-one video gallery All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter CVE-2026-1706 6.1 MediumMarch 4, 2026
• plugins360 all-in-one video gallery All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update CVE-2025-15516 4.3 MediumJanuary 24, 2026
• plugins360 all-in-one video gallery All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion CVE-2025-14947 6.5 MediumJanuary 23, 2026
• plugins360 all-in-one video gallery All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass CVE-2025-12957 8.8 HighJanuary 16, 2026
• plugins360 all-in-one video gallery All-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP CVE-2025-12966 8.8 HighDecember 6, 2025
• plugins360 automatic youtube gallery WordPress Automatic YouTube Gallery plugin <= 2.3.3 - Broken Access Control vulnerability CVE-2023-41866 4.3 MediumDecember 13, 2024
• 5starplugins easy age verify, featured images in rss for mailchimp & more, marijuana age verify +619 more +621 more Freemius SDK <= 2.4.2 - Missing Authorization Checks CVE-2022-4974 6.3 MediumOctober 16, 2024
• plugins360 all-in-one video gallery All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode CVE-2024-6629 6.4 MediumJuly 24, 2024
• plugins360 all-in-one video gallery WordPress All-in-One Video Gallery plugin <= 3.5.2 - Broken Access Control vulnerability CVE-2024-31248 4.3 MediumJune 9, 2024
• plugins360 all-in-one video gallery All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode CVE-2024-4670 8.8 HighMay 15, 2024
• plugins360 all-in-one video gallery All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image CVE-2024-4033 8.8 HighMay 2, 2024
• plugins360 all-in-one video gallery The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and... CVE-2022-2633 EPSS 35.7% 7.5 HighSeptember 6, 2022
• plugins360 all-in-one video gallery All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion CVE-2021-24970 7.2 HighDecember 13, 2021