CVE-2025-15516

Name of the Vulnerable Software and Affected Versions All-in-One Video Gallery plugin for WordPress versions 4.1.0 through 4.6.4

Description The All-in-One Video Gallery plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check within the ajax callback store user meta() function. Authenticated attackers with Subscriber-level access or higher can update arbitrary string-based user meta keys for their own account. The vulnerable function is ajax callback store user meta().

Recommendations Update to a version beyond 4.6.4.