Unknown All In One Video Gallery vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown All In One Video Gallery, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.2CVE-2021-24970plugins360all-in-one_video_gallery+2
EPSS score
5.01%
The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue6.4CVE-2026-19075unknownall-in-one video gallery+1
EPSS score
0.27%
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester.