{"id":"CVE-2026-120409","published":"2026-11-09T07:17:28.613","lastModified":"2026-11-10T16:28:46.510","description":"The All-in-One Video Gallery  WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-200"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/9338a9fe-f978-444c-883c-697b0c581bc5/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}