The All-in-One Video Gallery plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). Specifically, the plugin fails to adequately sanitize and escape user-supplied attributes in its Video shortcode, allowing authenticated users with contributor-level privileges or higher to inject arbitrary scripts. These scripts execute in the context of any user who accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 3.7.1. A fix has been released by the vendor.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to unauthorized actions performed on behalf of users, data theft, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity. No known exploits in the wild have been reported at this time.

A patch is available to remediate this vulnerability. Users of the All-in-One Video Gallery plugin should update to the latest version beyond 3.7.1 where the issue is fixed. Until patched, restrict contributor-level access to trusted users only to reduce risk.