CVE-2026-1706

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1706", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-30T15:59:08.979Z", "datePublished": "2026-03-04T09:24:30.422Z", "dateUpdated": "2026-04-08T17:18:47.058Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:47.058Z"}, "affected": [{"vendor": "plugins360", "product": "All-in-One Video Gallery", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.7.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The All-in-One Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vi' parameter in all versions up to, and including, 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bcaff8ab-2db9-4d91-9b7a-f7f49f5952b9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.1/public/videos.php#L776"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.1/includes/helpers/render.php#L304"}, {"url": "https://plugins.trac.wordpress.org/changeset/3469442/all-in-one-video-gallery/trunk/public/videos.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2026-01-30T16:14:35.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-03T20:24:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T15:01:33.268691Z", "id": "CVE-2026-1706", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T15:01:39.804Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1706", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T15:01:33.268691Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T15:01:36.328Z"}}], "cna": {"title": "All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "plugins360", "product": "All-in-One Video Gallery", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.7.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-30T16:14:35.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-03T20:24:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bcaff8ab-2db9-4d91-9b7a-f7f49f5952b9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.1/public/videos.php#L776"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.1/includes/helpers/render.php#L304"}, {"url": "https://plugins.trac.wordpress.org/changeset/3469442/all-in-one-video-gallery/trunk/public/videos.php"}], "descriptions": [{"lang": "en", "value": "The All-in-One Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vi' parameter in all versions up to, and including, 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-04T09:24:30.422Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1706", "state": "PUBLISHED", "dateUpdated": "2026-03-04T15:01:39.804Z", "dateReserved": "2026-01-30T15:59:08.979Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-04T09:24:30.422Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "All-in-One Video Gallery", "vendor": "plugins360", "versions": [{"lessThanOrEqual": "4.7.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The All-in-One Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vi' parameter in all versions up to, and including, 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin All-in-One Video Gallery para WordPress es vulnerable a cross-site scripting reflejado a trav\u00e9s del par\u00e1metro 'vi' en todas las versiones hasta la 4.7.1, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-1706", "lastModified": "2026-06-17T10:16:22.027", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1706", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T15:01:33.268691Z", "version": "2.0.3"}}]}, "published": "2026-03-04T10:16:07.963", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.1/includes/helpers/render.php#L304"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.1/public/videos.php#L776"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3469442/all-in-one-video-gallery/trunk/public/videos.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bcaff8ab-2db9-4d91-9b7a-f7f49f5952b9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.7.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "All-in-One Video Gallery", "source": "cna", "vendor": "plugins360"}, "product": "all-in-one_video_gallery", "vendor": "plugins360"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:56:24.361450+00:00", "value": {"mitigation_remediation": ["Upgrade the All\u2011In\u2011One Video Gallery plugin to a version released after 4.7.1 where the 'vi' parameter is properly sanitized and escaped.", "If an upgrade is not immediately feasible, disable the plugin or remove the 'vi' parameter from public URLs to eliminate the reflection surface.", "Ensure that WordPress and the web server enforce a strong content security policy (CSP) so that even if a malicious script is reflected, it cannot execute in the victim\u2019s browser."], "summary": {"action": "Patch Now", "impact": "Cross\u2011Site Scripting (Reflected)"}, "threat_synthesis": {"affected_systems": "All\u2011In\u2011One Video Gallery, a WordPress plugin developed by plugins360, is affected in all releases up through 4.7.1. Users running any of those versions on their WordPress sites must consider the plugin vulnerable.", "description_and_impact": "The vulnerability arises from the plugin's failure to properly sanitize or escape the value supplied in the 'vi' query parameter. An unauthenticated user can embed arbitrary JavaScript code that is reflected back to the requesting browser, enabling client\u2011side code execution. This flaw could allow attackers to hijack user sessions, steal cookies, or modify page content. The weakness is a classic reflected Cross\u2011Site Scripting flaw identified as CWE\u201179.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 6.1, indicating moderate severity. The EPSS score of less than 1\u202f% suggests a low probability that exploitation is occurring or will happen soon. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to lure a victim into clicking a crafted URL that contains malicious content in the 'vi' parameter, a scenario that is straightforward but does not require elevated privileges or access to the site\u2019s administration interface."}}}}, "created": "2026-03-04T21:03:42.570645+00:00", "updated": "2026-04-15T18:00:15.503726+00:00", "vendors": ["plugins360", "plugins360$PRODUCT$all-in-one_video_gallery", "wordpress", "wordpress$PRODUCT$wordpress"]}