The vulnerability arises from the plugin's failure to properly sanitize or escape the value supplied in the 'vi' query parameter. An unauthenticated user can embed arbitrary JavaScript code that is reflected back to the requesting browser, enabling client‑side code execution. This flaw could allow attackers to hijack user sessions, steal cookies, or modify page content. The weakness is a classic reflected Cross‑Site Scripting flaw identified as CWE‑79.

All‑In‑One Video Gallery, a WordPress plugin developed by plugins360, is affected in all releases up through 4.7.1. Users running any of those versions on their WordPress sites must consider the plugin vulnerable.

The vulnerability carries a CVSS score of 6.1, indicating moderate severity. The EPSS score of less than 1 % suggests a low probability that exploitation is occurring or will happen soon. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to lure a victim into clicking a crafted URL that contains malicious content in the 'vi' parameter, a scenario that is straightforward but does not require elevated privileges or access to the site’s administration interface.