CVE WatchOct 24, 2026

CVE-2026-114693

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Galle

CVSS

6.5

Medium

EPSS

—

KEV

—

Exploit Today

0-100

Published: Oct 24, 2026 · Last modified: Oct 24, 2026 · CWE-79

EPSS · 30d

Not enough EPSS history yet.

Technical description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 4.9.7.

Official references

patchstack.comhttps://patchstack.com/database/wordpress/plugin/all-in-one-video-gallery/vulnerability/wordpress-all-in-one-video-gallery-plugin-4-9-7-cross-site-scripting-xss-vulnerability?_s_id=cve

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1141946.5 MED

—

——0Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.6h CVE-2026-1159936.8 MED

—

——0Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges7h CVE-2026-1146977.1 HIG

—

——0Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.8h CVE-2026-1146957.1 HIG

—

——0Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.8h CVE-2026-1146947.1 HIG

—

——0Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.8h CVE-2026-1141797.1 HIG

—

——0Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.8h