# CVE-2026-109209: All-in-One Video Gallery plugin stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-109209-the-all-in-one-video-gallery-video-player-galleries-for-youtube  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-109209 · Severity: medium · CVSS 6.4 · Published 2026-10-28

The All-in-One Video Gallery plugin for WordPress allows authenticated attackers to inject malicious scripts into video gallery pages. When other users view pages containing the injected code, the malicious scripts execute in their browsers, potentially allowing attackers to steal credentials, deface content, or perform actions on behalf of the victims. The vulnerability can be exploited by any subscriber-level user through WordPress's XML-RPC interface.

Technologies: [All-in-One Video Gallery](https://junglewise.ai/threats/technologies/all-in-one-video-gallery-all-in-one-video-gallery). Vendors: [All-in-One Video Gallery](https://junglewise.ai/threats/vendors/all-in-one-video-gallery).

## Quick answers

**Is CVE-2026-109209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109209 being exploited in the wild.

**How severe is CVE-2026-109209?** Medium severity, with a CVSS score of 6.4, published 28 October 2026.

**Which products and versions are affected?** All-in-One Video Gallery up to and including 4.9.7.

**Is there a fix for CVE-2026-109209?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109209 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109209?** Check whether you run All-in-One Video Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the plugin's handling of the 'custom_fields[embedcode]' parameter due to insufficient input sanitization and output escaping. The vulnerability is reachable via XML-RPC requests where the save_meta_data() handler returns early because $_POST['post_type'] is absent, bypassing normal sanitization logic. The plugin grants all subscribers the publish_aiovg_videos capability by default, allowing any authenticated user to inject arbitrary web scripts that persist and execute for all subsequent page visitors.

## Affected products

- All-in-One Video Gallery All-in-One Video Gallery up to and including 4.9.7

## Timeline

- 2026-10-28: advisory

## References

- [https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/admin/videos.php](https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/admin/videos.php)
- [https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/includes/player/base.php](https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/includes/player/base.php)

## Related threats

- [All-in-One Video Gallery stored XSS via thumbnail URL](https://junglewise.ai/threats/cve-2026-120408-the-all-in-one-video-gallery-wordpress-plugin-before-5-1-0-does)
- [All-in-One Video Gallery stored XSS in shortcode attributes](https://junglewise.ai/threats/cve-2026-118783-the-all-in-one-video-gallery-wordpress-plugin-before-5-0-0-does)
- [All-in-One Video Gallery information disclosure of private videos](https://junglewise.ai/threats/cve-2026-118629-the-all-in-one-video-gallery-wordpress-plugin-before-5-0-0-does)