CVE-2026-119259— All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write
Quick assessment
Affected
Unknown All-in-One Video Gallery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 5.1.0 版本之前的 All-in-One Video Gallery WordPress 插件，在写入帖子的观看次数和时长元数据之前，未对目标帖子的类型、状态或所有权进行检查。这使得未认证的访客能够在任意帖子（包括私密帖子和草稿帖子）上创建或修改相关元数据，并可无限制地虚增观看次数。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-119259
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write
Source: CVE Program / CVE List V5
Vulnerability Description
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | All-in-One Video Gallery | 0 ~ 5.1.0 | - |
|
II. Public POCs for CVE-2026-119259
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-119259
请登录查看更多情报信息。
Other References for CVE-2026-119259 (1)
-
https://wpscan.com/vulnerability/9595e671-3012-4809-a1c7-7f3690bf0455/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-11-06 · 30 CVEs total
| CVE-2026-118423 | 10.0 CRITICAL | WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload |
| CVE-2026-88800 | 9.1 CRITICAL | MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Rol |
| CVE-2026-88799 | 8.8 HIGH | MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover |
| CVE-2026-88801 | 8.0 HIGH | MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Ro |
| CVE-2026-121633 | 5.3 MEDIUM | Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Liste |
| CVE-2026-121636 | 5.3 MEDIUM | Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the |
| CVE-2026-118166 | 4.8 MEDIUM | MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution vi |
| CVE-2026-110813 | Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Nam | |
| CVE-2026-118239 | AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth | |
| CVE-2026-118188 | PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure | |
| CVE-2026-115673 | Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email | |
| CVE-2026-118167 | MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override | |
| CVE-2026-118187 | PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR | |
| CVE-2026-118186 | PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revi | |
| CVE-2026-86606 | iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser | |
| CVE-2026-110525 | MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent | |
| CVE-2026-113615 | GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi | |
| CVE-2026-92396 | Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css | |
| CVE-2026-12967 | WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass | |
| CVE-2026-87784 | Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: All-in-One Video Gallery
-
CVE-2026-120408
All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS vi -
CVE-2026-118783
All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS v -
CVE-2026-118629
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private a -
CVE-2026-114693
WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross S -
CVE-2026-19075
All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side R
Same vendor: Unknown
-
CVE-2026-121636
Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IP -
CVE-2026-121633
Order Tracking < 3.6.0 - Unauthenticated Payment Confirmatio -
CVE-2026-118166
MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Ar -
CVE-2026-118423
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary Fi -
CVE-2026-88801
MDJM Event Management and Mobile Events Manager <= 1.7.8.7 -