Threats tagged 'ghsa-662v-5695-44hx'

The All-in-One Video Gallery WordPress plugin up to version 5.0.0 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'custom_fields[].value.label' parameter when the Player Library is set to Plyr/Vidstack. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping in the Plyr/Vidstack template path.