What’s Vulnerable › Products

plugins360 All-in-One Video Gallery vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your plugins360 All-in-One Video Gallery version is affected

Latest plugins360 All-in-One Video Gallery vulnerabilities

• CVE-2026-19075 — All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter (CVSS 5.0)
• CVE-2026-12123 — All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter (CVSS 6.4)
• CVE-2026-1706 — All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter (CVSS 6.1)
• CVE-2025-15516 — All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update (CVSS 4.3)
• CVE-2025-14947 — All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion (CVSS 6.5)
• CVE-2025-12957 — All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass (CVSS 8.8)
• CVE-2025-12966 — All-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP (CVSS 8.8)
• CVE-2022-4974 — Freemius SDK <= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
• CVE-2024-6629 — All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode (CVSS 5.4)
• CVE-2024-31248 — WordPress All-in-One Video Gallery plugin <= 3.5.2 - Broken Access Control vulnerability (CVSS 8.8)
• CVE-2024-4670 — All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode (CVSS 8.8)
• CVE-2024-4033 — All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image (CVSS 8.8)
• CVE-2022-2633 — (CVSS 8.2)
• CVE-2021-24970 — All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion (CVSS 7.2)