{
 "id": "WPSEC-2026-2447",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2447/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2447/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2447/index.md",
 "title": "All-in-One Video Gallery <= 5.0.0 - Unauthenticated Server-Side Request Forgery via WordPress.com Video Source",
 "description": "The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery via the WordPress.com HLS source filter in all versions up to, and including, 5.0.0 due to the video source URL, which can be supplied through the player URL's query string, being validated only by a substring check for 'videos.files.wordpress.com' before being requested with wp_remote_get(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to probe internal services.",
 "plugin": {
  "slug": "all-in-one-video-gallery",
  "name": "All-in-One Video Gallery",
  "full_name": "All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos",
  "wordpress_org": "https://wordpress.org/plugins/all-in-one-video-gallery/",
  "advisories_url": "https://wpsec.com/vuln/plugin/all-in-one-video-gallery/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/all-in-one-video-gallery"
 },
 "type": "SSRF",
 "cwe": [
  "CWE-918"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.1.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.1.0",
 "remediation": "Update to 5.1.0 or later.",
 "fix_released": "2026-11-03T06:12:08+00:00",
 "published": "2026-11-04T06:43:43+00:00",
 "updated": "2026-11-03T13:21:01.226504+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2447/",
  "https://plugins.svn.wordpress.org/all-in-one-video-gallery/tags/5.1.0/",
  "https://wordpress.org/plugins/all-in-one-video-gallery/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/all-in-one-video-gallery",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}