WordPress Video Gallery Plugin Stored XSS via Thumbnail URL

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The All-in-One Video Gallery WordPress plugin before version 5.1.0 contains a stored cross-site scripting (XSS) vulnerability in how it handles video thumbnail URLs. When a thumbnail URL is stored in the database, the plugin fails to properly escape the output when displaying it in the admin video list, and critically, fails to sanitize the value when it's rendered outside the plugin's editor. This allows attackers with subscriber-level privileges—the lowest authenticated role in WordPress—to inject malicious scripts that execute in administrator browsers, potentially leading to account takeover, data theft, or further plugin compromise. With 323 matching skills in Casky's framework, this vulnerability represents a significant privilege escalation and persistent attack vector affecting WordPress installations using this plugin.

Casky's Claude-powered detection engine maps this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance), identifying the attack chain as an initial foothold followed by privilege escalation and persistence. Practitioners using Casky would see findings highlighting inadequate input validation (CWE-79) patterns where user-controlled data—the thumbnail URL—flows directly into output contexts without escaping. The extended reasoning capability would surface that stored XSS attacks differ from reflected variants by persisting in the database, affecting any administrator who views the video list. Practitioners would observe detection signals around subscriber account activity creating or modifying video gallery entries with payload-bearing URLs, combined with admin session indicators accessing the compromised admin list view—the classic indicators of stored XSS exploitation in WordPress environments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-120408.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-120408

Casky has 323 skills that investigate the attack patterns behind CVE-2026-120408. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn