PLUGIN SECURITY
Is All In One Video Gallery safe?
Video gallery plugin for WordPress with a built-in HTML5 player. Embed YouTube, Vimeo, Dailymotion, Rumble, and self-hosted videos.
What this plugin does
- Slug:
all-in-one-video-gallery - Author: Plugins360 Labs
- 20000+ active installs
- 96/100 rating (137 reviews on wordpress.org)
- 922425 all-time downloads
- On WordPress.org since 2017-12-19
HTML5 videovideo galleryvideo playervimeoyoutube
Maintenance status
- Last updated: 2026-11-05 5:16am GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 5.6.20+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
24 known CVEs on file for All In One Video Gallery.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-120409 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.1.1 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 5.1.1 | 5.1.1 | 2026-11-07 | — |
| CVE-2026-120408 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.1.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 5.1.0 | 5.1.0 | 2026-11-06 | — |
| CVE-2026-119259 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.1.0 | Missing Authorization | Unknown | < 5.1.0 | 5.1.0 | 2026-11-06 | — |
| CVE-2026-120838 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.1.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 5.1.0 | 5.1.0 | 2026-11-06 | — |
| CVE-2026-118783 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.0.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 5.0.0 | 5.0.0 | 2026-11-04 | — |
| CVE-2026-116545 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.1.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 5.1.0 | 5.1.0 | 2026-11-04 | — |
| CVE-2026-109974 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.0.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 5.0.0 | 5.0.0 | 2026-10-27 | — |
| CVE-2026-109209 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.0.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 5.0.0 | 5.0.0 | 2026-10-27 | — |
+ 22 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-118629 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.0.0 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 5.0.0 | 5.0.0 | 2026-10-27 | — |
| CVE-2026-114693 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 5.0.0 | — | Medium 6.5 | < 5.0.0 | 5.0.0 | 2026-10-24 | — |
| CVE-2026-12123 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 4.9.0 | Server-Side Request Forgery (SSRF) | Medium 6.4 | < 4.9.0 | 4.9.0 | 2026-07-09 | — |
| CVE-2026-19075 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 4.9.2 | Server-Side Request Forgery (SSRF) | Unknown | < 4.9.2 | 4.9.2 | 2026-07-09 | — |
| CVE-2025-15516 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 4.7.1 | Missing Authorization | Medium 4.3 | < 4.7.1 | 4.7.1 | 2026-01-23 | — |
| CVE-2025-14947 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 4.7.1 | Missing Authorization | Medium 6.5 | < 4.7.1 | 4.7.1 | 2026-01-22 | — |
| CVE-2025-12957 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 4.6.4 | Unrestricted Upload of File with Dangerous Type | High 8.8 | < 4.6.4 | 4.6.4 | 2026-01-15 | — |
| CVE-2025-12966 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 4.6.4 | Unrestricted Upload of File with Dangerous Type | High 8.8 | < 4.6.4 | 4.6.4 | 2025-12-05 | — |
| CVE-2024-6629 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 3.8.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.8.3 | 3.8.3 | 2024-07-23 | — |
| CVE-2024-4670 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 3.7.0 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | High 8.8 | < 3.7.0 | 3.7.0 | 2024-05-14 | — |
| CVE-2024-4033 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 3.6.5 | Unrestricted Upload of File with Dangerous Type | High 8.8 | < 3.6.5 | 3.6.5 | 2024-05-01 | — |
| CVE-2024-31248 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 3.6.0 | Missing Authorization | High 8.8 | < 3.6.0 | 3.6.0 | 2024-04-05 | — |
| — | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 3.4.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 3.4.3 | 3.4.3 | 2023-07-18 | — |
| CVE-2022-2633 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 2.6.1 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 8.2 | < 2.6.1 | 2.6.1 | 2022-08-17 | — |
| — | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 2.5.4 | Missing Authorization | Medium 6.3 | < 2.5.4 | 2.5.4 | 2022-03-04 | — |
| — | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 2.5.4 | — | Unknown | < 2.5.4 | 2.5.4 | 2022-02-28 | — |
| — | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 2.5.4 | — | Unknown | < 2.5.4 | 2.5.4 | 2022-02-28 | — |
| CVE-2021-24970 | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 2.5.4 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.2 | < 2.5.4 | 2.5.4 | 2021-11-15 | — |
| — | All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery] < 4.7.5 | — | Unknown | < 4.7.5 | 4.7.5 | 0000-00-00 | — |
| — | Unauthorised AJAX Calls via Freemius | — | Unknown | < 2.5.4 | 2.5.4 | — | — |
| CVE-2023-33999 | Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting | — | Unknown | < 3.4.3 | 3.4.3 | — | — |
| CVE-2026-1706 | All-in-One Video Gallery < 4.7.5 - Reflected Cross-Site Scripting via 'vi' Parameter | — | Unknown | < 4.7.5 | 4.7.5 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Modula Image Gallery – Photo Grid & Video Gallery — 100000+ active installs — 94/100 (617) — max PHP 8.4
- Gallery by Visual Portfolio — 50000+ active installs — 96/100 (340) — max PHP 8.4
- SimpLy Gallery — 40000+ active installs — 96/100 (118) — max PHP 8.4
- Portfolio Filter Gallery – Photo Gallery — 20000+ active installs — 96/100 (348)
- FV Flowplayer Video Player — 10000+ active installs — 88/100 (90)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.