What is GHSA-3v4w-8jh3-gmw5?

GHSA-3v4w-8jh3-gmw5 is a security advisory published by GitHub Security Advisories with Medium severity. The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is...

Which CVE IDs does GHSA-3v4w-8jh3-gmw5 cover?

GHSA-3v4w-8jh3-gmw5 covers the following CVE IDs: CVE-2026-120409. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3v4w-8jh3-gmw5?

GHSA-3v4w-8jh3-gmw5 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-3v4w-8jh3-gmw5MediumCVSS 5.3

The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is...

Vendor

GitHub Security Advisories

Published

November 9, 2026

Last Modified

November 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-120409 →

📋 Description

The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-120409
https://wpscan.com/vulnerability/9338a9fe-f978-444c-883c-697b0c581bc5
https://github.com/advisories/GHSA-3v4w-8jh3-gmw5