CVE-2026-114693 Plugins360 Labs CVE debrief

Who should care

Defenders responsible for WordPress installations with the All-in-One Video Gallery plugin should assess exposure and prioritize patching or mitigation. This includes reviewing the plugin version, applying patches or updates, and monitoring for potential attacks. Additionally, defenders should consider the potential impact on user interactions with the affected plugin and take steps to prevent malicious script injection and execution.

Why it matters

Defenders should care about CVE-2026-114693 because it involves a Cross-site Scripting vulnerability in the All-in-One Video Gallery plugin for WordPress, allowing for Stored XSS attacks. This requires verification of exposure, prioritization of patching or mitigation, and monitoring for potential attacks.

• Potential for malicious script injection and execution.
• Possible impact on user interactions with the affected plugin.
• Need for verification of exposure and application of patches or mitigations.

Technical summary

The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-site Scripting (XSS). The issue affects versions from n/a through 4.9.7 and allows for the injection of malicious scripts. This vulnerability can lead to potential security breaches and requires immediate attention from defenders. The vulnerability exists due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential attacks.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations.

Recommended defensive actions

• Verify exposure by checking if the All-in-One Video Gallery plugin version is within the affected range.
• Apply patches or updates to the plugin to mitigate the vulnerability.
• Monitor for potential XSS attacks targeting the plugin.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation or impact is limited. Defenders should verify exposure by checking plugin versions and apply patches or updates to mitigate the vulnerability. The vulnerability allows for Stored XSS attacks, which can lead to malicious script injection and execution. There is limited information on the scope of affected systems and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.