What is GHSA-32wc-jrqc-fp7p?

GHSA-32wc-jrqc-fp7p is a security advisory published by GitHub Security Advisories with Medium severity. The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or...

Which CVE IDs does GHSA-32wc-jrqc-fp7p cover?

GHSA-32wc-jrqc-fp7p covers the following CVE IDs: CVE-2026-119259. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-32wc-jrqc-fp7p?

GHSA-32wc-jrqc-fp7p has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-32wc-jrqc-fp7pMediumCVSS 5.3

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or...

Vendor

GitHub Security Advisories

Published

November 6, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-119259 →

📋 Description

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-119259
https://wpscan.com/vulnerability/9595e671-3012-4809-a1c7-7f3690bf0455
https://github.com/advisories/GHSA-32wc-jrqc-fp7p