The All‑in‑One Video Gallery plugin for WordPress contains a stored cross‑site scripting flaw that allows an authenticated attacker with contributor or higher privileges to inject arbitrary JavaScript into the more_link shortcode attribute. When a page that includes this shortcode is viewed, the injected script runs in the context of the visitor’s browser, creating the possibility of defacement, credential theft, or session hijacking.

The vulnerability exists in the All‑in‑One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self‑Hosted Videos WordPress plugin for all versions up to and including 4.9.7. No other products or vendors are affected.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access; an attacker with contributor access can submit a malicious value for more_link via the plugin’s short‑code editor and the payload will be stored and later executed whenever the affected page is rendered. The stored nature of the payload means impact persists until the short‑code entry is removed or the plugin is patched.