Urgent: Reflected XSS in All-in-One Video Gallery (<= 4.7.1) — What WordPress Site Owners and Developers Must Do Right Now

Discovered: reflected Cross-Site Scripting (XSS) via the vi parameter in All-in-One Video Gallery plugin versions up to 4.7.1. Patch released in 4.7.5. CVE‑2026‑1706, CVSS: 7.1 (medium).

As a Hong Kong-based security expert, I write this advisory to provide concise, practical steps for site owners, developers and agencies across Hong Kong and the APAC region. This advisory explains the risk, how to detect exploitation, and immediate mitigations you can apply while you update. It does not promote any third-party WordPress security vendor; recommendations are vendor-neutral.

Executive summary (short)

• A reflected XSS issue was reported in All-in-One Video Gallery versions ≤ 4.7.1. Tracked as CVE‑2026‑1706.
• An attacker crafts a URL with a malicious payload in the vi query parameter; the parameter is reflected unsafely and executed in the victim’s browser.
• Impact includes session theft, unauthorized actions performed by the user’s browser, redirection to phishing or malware, UI manipulation and reputation damage.
• Definitive fix: update the plugin to version 4.7.5 or later immediately.
• If you cannot update right away, implement temporary mitigations: edge blocking (WAF rules), strict input validation, access restriction to pages using the plugin, and additional hardening (CSP, secure cookies, monitoring).

What is reflected XSS and why it matters for WordPress sites

Cross-Site Scripting (XSS) is a client-side code injection attack where an attacker causes a victim’s browser to execute attacker-controlled script. Reflected XSS happens when input from a request (for example, a query parameter) is returned in the server response without proper sanitization or encoding, and the victim is tricked into visiting that URL.

Why this is important:

• The malicious script runs in the context of your site; if an admin or authenticated user is targeted, that script can perform actions on behalf of the user.
• Cookies, CSRF tokens or other secrets accessible to JavaScript can be exfiltrated unless HttpOnly / Secure / SameSite are enforced or tokens are stored safely.
• Attackers can redirect visitors to phishing or malware, show fake login prompts, or manipulate the site UI to steal credentials.

In this specific case the vi parameter is reflected without proper filtering/encoding, which is sufficient to enable reflected XSS when a victim follows a crafted link.

Affected versions, CVE, and risk rating

• Affected plugin: All-in-One Video Gallery
• Vulnerable versions: ≤ 4.7.1
• Patched version: 4.7.5
• CVE: CVE‑2026‑1706
• Reported severity: Medium / CVSS 7.1
• Required privilege: none (attack can target unauthenticated users)
• Exploitation requires user interaction (clicking or visiting a crafted URL)

Typical exploitation scenarios

• Stealing session cookies or authentication tokens if they are accessible to JavaScript.
• Performing actions as an administrator via the admin’s browser session (creating posts, changing options, adding users).
• Injecting UI overlays or fake login prompts to collect credentials.
• Redirecting visitors to phishing or malware sites.
• Tricking an admin into pasting malicious content into a post editor, creating a persistent compromise.

How to prioritize response (site owner checklist)

1. Verify plugin version immediately. Log in to WordPress admin → Plugins and confirm the All-in-One Video Gallery plugin version. If it is ≤ 4.7.1, treat the site as vulnerable.
2. Update the plugin. Update to 4.7.5 or later as soon as possible — this is the definitive fix.
3. If you cannot update immediately, apply mitigations:
   • Deploy edge blocking rules (WAF) to block suspicious values for the vi parameter.
   • Restrict access to pages using the plugin to authenticated users where possible.
   • Apply a Content Security Policy (CSP) that disallows inline scripts and limits script sources.
4. Scan for signs of compromise. Run malware scans; review recent posts, admin activity, new users, modified files and scheduled tasks.
5. Harden your site. Keep all plugins, themes and WordPress core up to date, enforce strong admin passwords and multi-factor authentication, rotate salts and keys, and enable secure cookie flags.
6. Monitor logs and traffic. Watch for requests with vi containing encoded HTML, script tags, or suspicious payloads.

Detection: what to look for in logs and scans

• HTTP access logs with requests containing vi= that include:
  • Encoded or raw
    Review My Order

    0

    Subtotal

    Taxes & shipping calculated at checkout

    Checkout