CVE-2026-120409
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 09, 2026
Vendor
unknown
Description
The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.