Plugins360 vulnerabilities
We track 5 vulnerabilities in Plugins360 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on January 16, 2026.
Latest Plugins360 vulnerabilities
- 8.8 High severity
All-in-One Video Gallery: Unrestricted Upload of File with Dangerous Type
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.5.7. This is due to insufficient file type validation detecting VTT files, allowing double extension files to bypass sanitization w
- 8.8 High severity
All-in-One Video Gallery: Unrestricted Upload of File with Dangerous Type
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the resolve_import_directory() function in versions 4.5.4 to 4.5.7. This makes it possible for authenticated attackers, with Author
- 8.8 High severity
All-in-One Video Gallery: Improper Control of Filename for Include/Require Statement in PHP Program
The All-in-One Video Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.5 via the aiovg_search_form shortcode. This makes it possible for authenticated attackers, with contributor-level access and above
- 8.8 High severity
All-in-One Video Gallery: Unrestricted Upload of File with Dangerous Type
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the aiovg_create_attachment_from_external_image_url function in all versions up to, and including, 3.6.4. This makes it possible fo
- 8.2 High severity
All-in-One Video Gallery: Externally Controlled Reference to a Resource in Another Sphere
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for una