# CVE-2026-116545: All-in-One Video Gallery stored DOM-based XSS in track custom fields

Source: https://junglewise.ai/threats/cve-2026-116545-the-all-in-one-video-gallery-video-player-galleries-for-youtube  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-116545 · Severity: medium · CVSS 6.4 · Published 2026-11-06

The All-in-One Video Gallery WordPress plugin allows authenticated subscribers to inject malicious scripts via custom track field labels, which execute when visitors view a page containing the injected gallery. This vulnerability only affects sites using the Plyr/Vidstack player configuration rather than the default Video.js player. Attackers with subscriber-level access can compromise the security of site visitors.

Vendors: [WordPress.org](https://junglewise.ai/threats/vendors/wordpress-org).

## Quick answers

**Is CVE-2026-116545 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116545 being exploited in the wild.

**How severe is CVE-2026-116545?** Medium severity, with a CVSS score of 6.4, published 6 November 2026.

**Which products and versions are affected?** WordPress.org All-in-One Video Gallery up to and including 5.0.0.

**Is there a fix for CVE-2026-116545?** No fixed version is recorded yet. Ensure the site is configured to use the default Video.js player rather than Plyr/Vidstack, or restrict subscriber-level access to the video gallery administration interface until an updated plugin version is available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116545 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116545?** Check whether you run WordPress.org All-in-One Video Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Ensure the site is configured to use the default Video.js player rather than Plyr/Vidstack, or restrict subscriber-level access to the video gallery administration interface until an updated plugin version is available.

## Technical details

Stored DOM-based XSS vulnerability in the 'custom_fields[].value.label' parameter (for the 'track' key) caused by insufficient input sanitization and output escaping in the plugin's Plyr/Vidstack player template. Exploitation requires authenticated subscriber access and the site to be configured with Plyr/Vidstack as the player library; the vulnerable innerHTML sink does not exist in the default Video.js template path.

## Affected products

- Wordpress.org All-in-One Video Gallery up to and including 5.0.0

## Timeline

- 2026-11-06: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/5.0.0/admin/videos.php](https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/5.0.0/admin/videos.php)
- [https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/5.0.0/admin/videos.php](https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/5.0.0/admin/videos.php)