The All‑in‑One Video Gallery plugin stores a 'track' post meta label without proper escaping, allowing an authenticated user with subscriber or higher privileges to inject arbitrary JavaScript. When the page that displays the track item is later viewed, the injected script executes in the victim’s browser, potentially compromising their session, defacing the site, or performing click‑jacking or phishing attacks. The flaw is a classic stored DOM‑based XSS that elevates the impact of a casual privilege‑based attack to a bypass of access control and user trust.

All versions of the WordPress plugin All‑in‑One Video Gallery up to and including 5.0.0 are affected. The vulnerability materializes only when the plugin’s Player Library option is set to Plyr/Vidstack, not the default Video.js template. All WordPress sites that have installed or upgraded this plugin and configured it for Plyr/Vidstack are susceptible.

The CVSS score of 6.4 indicates medium severity. Because EPSS data is not available and the flaw is not in the CISA KEV catalog, the global exploitation probability is unclear, but the requirement for authenticated subscriber access makes casual exploitation less likely. Nevertheless, once an attacker gains the necessary credentials they can target all visitors to the affected media pages, creating a moderate to high risk scenario for websites that rely on this plugin.