Is CVE-2026-118629 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-118629

Description

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.