CVE-2021-24970: All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-13 · updated 2026-06-17
Weakness: CWE-22

Description

The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue

Affected products

plugins360 All-in-One Video Gallery: before 2.5.0 — fixed in 2.5.0

How to fix

Upgrade to a fixed version: plugins360 All-in-One Video Gallery 2.5.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/9b15d47e-43b6-49a8-b2c3-b99c92101e10
https://wpscan.com/vulnerability/9b15d47e-43b6-49a8-b2c3-b99c92101e10

Get alerted when CVE-2021-24970 or the next vulnerability affects your stack