Description
WordPress Plugin All-in-One Video Gallery is prone to multiple vulnerabilities, including arbitrary file download and server-side request forgery vulnerabilities. Exploiting these issues may allow an attacker to gain access to sensitive information, which may aid in launching further attacks, or to make the vulnerable server perform port scanning of hosts in internal or external networks; other attacks are also possible. WordPress Plugin All-in-One Video Gallery versions 2.5.8 - 2.6.0 are vulnerable.
Remediation
Update to plugin version 2.6.1 or latest
References
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2633
https://plugins.svn.wordpress.org/all-in-one-video-gallery/trunk/README.txt
Related Vulnerabilities
MySQL CVE-2018-3283 Vulnerability (CVE-2018-3283)
OpenSSL Numeric Errors Vulnerability (CVE-2016-2106)
Sqlite Incorrect Conversion between Numeric Types Vulnerability (CVE-2019-19317)
WordPress Plugin WP Open Graph Cross-Site Request Forgery (1.6.1)
phpMyAdmin Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-5621)