All vulnerabilities
—
High
CVSS 7.4
Multiple vulnerabilities in Automatic YouTube Gallery
| Vendor | Plugins360 Labs |
|---|---|
| Product | Automatic YouTube Gallery |
| Affected versions | < 2.9.0 |
| Reported | 2026-08-10 |
| Disclosed | 2026-08-10 |
| Status | Vendor fixed |
Discovered and responsibly reported multiple security vulnerabilities in the WordPress plugin "Automatic YouTube Gallery" developed by Plugins360 Labs.
The reported issues included:
• Unauthenticated gallery manipulation vulnerabilities.
• YouTube API quota exhaustion issues.
• Pagination token validation weaknesses.
• URL parameter injection vulnerabilities.
• Thumbnail data handling weaknesses.
All findings were acknowledged by the vendor and fixed in version 2.9.0. The developer officially credited me in the plugin changelog for the responsible disclosure of these security issues.
The reported issues included:
• Unauthenticated gallery manipulation vulnerabilities.
• YouTube API quota exhaustion issues.
• Pagination token validation weaknesses.
• URL parameter injection vulnerabilities.
• Thumbnail data handling weaknesses.
All findings were acknowledged by the vendor and fixed in version 2.9.0. The developer officially credited me in the plugin changelog for the responsible disclosure of these security issues.
Related disclosures
High
Simple Shopping Cart < 5.3.3 – Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient
Medium
Elementor < 4.3.5 – Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
Low
Code Snippets < 3.10.0 – Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
Low
The Events Calendar 6.15.16.1 – 6.17.4.1 – Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
View all