The vulnerability is an improper neutralization of input during web page generation, allowing attackers to inject arbitrary scripts that are stored in the plugin's output. Because the data is stored in the database, it is rendered to all site visitors without sanitization. This stored XSS can lead to credential theft, session hijacking, cookie theft, or defacement of the site, depending on the victim's permissions. The weakness is classified as CWE-79.

The affected component is the All‑in‑One Video Gallery plugin developed by Plugins360 Labs. Versions from the earliest release up to and including 4.9.7 are vulnerable. All WordPress sites installing any of those versions are at risk. Sites that have not yet upgraded or that continue to run older releases must be addressed.

CVSS base score is 6.5, indicating a moderate severity. EPSS data is not available, so the current likelihood of exploitation cannot be quantified from the existing dataset. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through the plugin’s interface that accepts user‑supplied content; an attacker with content‑submission privileges could create the malicious payload, or a site‑administrator could craft a malicious entry. Once stored, the script executes in all users browsing the affected page. External exploitation would require the plugin to be enabled and the attacker to supply the malicious input.