CVE-2021-24970
HIGH NUCLEIAll-in-One Video Gallery <2.5.0 - Code Injection
Title source: llmExploitation Summary
CVE-2021-24970 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue
Nuclei Templates (1)
WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion
HIGHVERIFIEDby r3Y3r53
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/9b15d47e-43b6-49a8-b2c3-b99c92101e10
Scores
CVSS v3
7.2
EPSS
0.0590
EPSS Percentile
92.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-22
Status
published
Products (1)
plugins360/all-in-one_video_gallery
< 2.5.0
Published
Dec 13, 2021
Tracked Since
Feb 18, 2026