The All‑In‑One Video Gallery plugin for WordPress suffers from insufficient file type validation during VTT uploads. A double extension technique allows an authenticated user with author or higher privileges to upload files that bypass the VTT sanitization and are stored on the server. This flaw can be used to place malicious scripts or other executable files, potentially leading to remote code execution if the attacker can subsequently invoke the uploaded file.

The vulnerability affects the plugins360 All‑In‑One Video Gallery product on WordPress. All released versions up to and including 4.5.7 are vulnerable. Sites running any of these versions with users who have author‑level access or higher are at risk.

The flaw carries a CVSS score of 8.8, indicating high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and it is not listed in the CISA KEV catalog. Nevertheless, the exploit requires only authenticated author access, which is common on many sites, and the flaw can lead to file upload that may enable remote code execution if the server permits execution of uploaded files.