The All‑In‑One Video Gallery WordPress plugin fails to escape a video's stored thumbnail URL before rendering it in the administrative list view and does not sanitize that value when it is stored. This deficiency allows users with a Subscriber or lower role to inject malicious JavaScript that is stored persistently and executed when an administrator views the video list. The resulting XSS can lead to credential theft, defacement, or broader compromise of the WordPress site. The weakness is a classic Stored XSS vulnerability, corresponding to CWE‑79.

Any WordPress site that has the All‑In‑One Video Gallery plugin installed in a version prior to 5.1.0 is affected. The vulnerability resides in the plugin’s handling of the post meta field that holds the thumbnail URL and is triggered through the plugin’s administrative user interface.

The attack vector is via the plugin’s admin interface and requires an attacker to create or modify a video post with a crafted thumbnail URL. Because the flaw is stored, repeated exploitation is possible. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, which suggests a low to medium exploitation probability under current conditions. Nevertheless, the potential impact of executing arbitrary client‑side code in an administrator’s session warrants a high‑severity assessment and immediate remediation.