https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 01:18:47 +0000 https://cve.radiocsirt.org/vuln/cve-2026-12123 <p><strong>Affected:</strong> plugins360 All-in-One Video Gallery</p> <p>The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the &#39;vdl&#39; parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. A Subscriber-level attacker can plant an internal or loopback URL in the `mp4` post meta of a newly created `aiovg_videos` post via XML-RPC `wp.newPost`, then trigger the unauthenticated `?vdl=&lt;post_id&gt;` endpoint to force the server to fetch that URL and stream the full response body back to the requester.</p> <p><strong>Affected:</strong> plugins360 All-in-One Video Gallery</p> <p>The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the &#39;vdl&#39; parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. A Subscriber-level attacker can plant an internal or loopback URL in the `mp4` post meta of a newly created `aiovg_videos` post via XML-RPC `wp.newPost`, then trigger the unauthenticated `?vdl=&lt;post_id&gt;` endpoint to force the server to fetch that URL and stream the full response body back to the requester.</p> https://cve.radiocsirt.org/vuln/cve-2026-12123