CVE-2026-109209

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is possible because the save_meta_data() handler returns early when $_POST['post_type'] is absent — a condition always true during XML-RPC requests — and the plugin unconditionally grants Subscribers the publish_aiovg_videos capability, making this exploitable by any authenticated user via a single wp.newPost XML-RPC call.

• CWE-79

• https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/admin/videos.php#L254
• https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/includes/player/base.php#L1028
• https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/includes/player/base.php#L277
• https://plugins.trac.wordpress.org/changeset/3759353/all-in-one-video-gallery/trunk/includes/player/base.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cc6b1fa7-d5f9-4aec-860e-067c26745450?source=cve

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-109203LogicalDOC Community Edition through 9.3 contains a missing …6.5
• CVE-2026-109204LogicalDOC Community Edition through 9.3 contains an imprope…6.3
• CVE-2026-109205LogicalDOC Community Edition through 9.3 contains an unauthe…7.5
• CVE-2026-109206LogicalDOC Community Edition through 9.3 contains a username…5.3
• CVE-2026-109207The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, N…7.2
• CVE-2026-109208The LearnPress – WordPress LMS Plugin for Create and Sell On…7.2
• CVE-2026-10921Integer overflow in Dawn in Google Chrome prior to 149.0.782…8.3
• CVE-2026-109218The Contact Manager plugin for WordPress is vulnerable to Ar…9.8
• CVE-2026-109219The Mang Board plugin for WordPress is vulnerable to Arbitra…9.8
• CVE-2026-10922Insufficient validation of untrusted input in DevTools in Go…8.8
• CVE-2026-109221The Groundhogg — CRM, Newsletters, and Marketing Automation …8.1
• CVE-2026-109222Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…