{"id":"CVE-2026-118783","published":"2026-11-04T06:17:03.517","lastModified":"2026-11-04T06:17:03.517","description":"The All-in-One Video Gallery  WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/119477bd-1b29-4e33-9040-38cb6f0ae623/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}