🔎 Have you found a vulnerability in a WordPress plugin or theme? Report vulnerabilities in WordPress plugins and themes through our bug bounty program and earn a bounty on all in-scope submissions, while we handle the responsible disclosure process on your behalf.

All-in-One Video Gallery

Wordfence Intelligence > Vulnerability Database > WordPress Plugins > All-in-One Video Gallery

Information

Software Type	Plugin
Software Slug	all-in-one-video-gallery (view on wordpress.org)
Software Status	Active
Software Author	plugins360
Software Website	plugins360.com
Software Downloads	596,782
Software Active Installs	20,000
Software Record Last Updated	July 27, 2024

8 Vulnerabilities

All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode

6.4

CVE-2024-6629

Jul 23, 2024

Researcher: Webbernaut

All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode

8.8

CVE-2024-4670

May 14, 2024

Researcher: Ngô Thiên An (ancorn_)

All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image

8.8

CVE-2024-4033

May 1, 2024

Researcher: stealthcopter

All-in-One Video Gallery <= 3.5.2 - Missing Authorization

4.3

CVE-2024-31248

Apr 5, 2024

Researcher: emad

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get

6.1

CVE-2023-33999

Jul 18, 2023

Researcher: Rafie Muhammad

All-in-One Video Gallery 2.5.8 - 2.6.0 - Arbitrary File Download & Server-Side Request Forgery

7.5

CVE-2022-2633

Aug 17, 2022

Researcher: Gabriele Zuddas

Freemius SDK <= 2.4.2 - Missing Authorization Checks

6.3

CVE ID Unknown

Mar 4, 2022

Researchers:

All-In-One-Gallery <= 2.4.9 - Admin+ Local File Inclusion

7.2

CVE-2021-24970

Nov 15, 2021

Researcher: Mohamed Magdy AbuMuslim

Title	Status	CVE ID	CVSS	Researchers	Date
All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode	Patched	CVE-2024-6629	6.4	Webbernaut	July 23, 2024
All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode	Patched	CVE-2024-4670	8.8	Ngô Thiên An (ancorn_)	May 14, 2024
All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image	Patched	CVE-2024-4033	8.8	stealthcopter	May 1, 2024
All-in-One Video Gallery <= 3.5.2 - Missing Authorization	Patched	CVE-2024-31248	4.3	emad	April 5, 2024
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get	Patched	CVE-2023-33999	6.1	Rafie Muhammad	July 18, 2023
All-in-One Video Gallery 2.5.8 - 2.6.0 - Arbitrary File Download & Server-Side Request Forgery	Patched	CVE-2022-2633	7.5	Gabriele Zuddas	August 17, 2022
Freemius SDK <= 2.4.2 - Missing Authorization Checks	Patched		6.3		March 4, 2022
All-In-One-Gallery <= 2.4.9 - Admin+ Local File Inclusion	Patched	CVE-2021-24970	7.2	Mohamed Magdy AbuMuslim	November 15, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation