All-in-One Video Gallery Security & Risk Analysis

The "all-in-one-video-gallery" plugin v4.7.5 presents a mixed security posture. While it demonstrates good practices in SQL query sanitization and a high percentage of properly escaped output, significant concerns arise from its attack surface. A substantial number of AJAX handlers (23 out of 24) lack proper authorization checks, creating a wide entry point for potential privilege escalation or unauthorized actions. Furthermore, the taint analysis, while not revealing critical or high severity issues in this scan, did identify flows with unsanitized paths, indicating a potential for path traversal vulnerabilities if these flows are triggered by user input.

The plugin's historical vulnerability data is a major red flag. A total of 11 known CVEs, with 6 high and 5 medium severity, suggests a pattern of recurring security weaknesses. The common vulnerability types listed (XSS, Missing Authorization, Unrestricted Upload, Path Traversal, PHP Remote File Inclusion) are all severe and can lead to complete site compromise. The fact that there are currently no unpatched CVEs is a positive, but the sheer volume and nature of past vulnerabilities point to a plugin that has historically been a target and may have underlying architectural issues that are difficult to fully remediate. The last vulnerability being in 2026 is likely a typo and should be treated with caution.

In conclusion, despite some positive technical indicators like prepared SQL statements and good output escaping, the substantial number of unprotected AJAX endpoints and the plugin's extensive history of high and medium severity vulnerabilities necessitate a cautious approach. Users should be aware of the potential risks associated with the broad attack surface and the historical pattern of exploitable flaws, even if the current version appears to have addressed past issues.