CVE-2026-118629

{"id": "CVE-2026-118629", "cveTags": [], "metrics": {}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "All-in-One Video Gallery", "versions": [{"status": "affected", "version": "0", "lessThan": "5.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-31T06:16:34.133", "references": [{"url": "https://wpscan.com/vulnerability/a17559f9-f2d6-434f-8dd0-db4d1d9766d2/", "source": "contact@wpscan.com"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID."}], "lastModified": "2026-10-31T06:16:34.133", "sourceIdentifier": "contact@wpscan.com"}