CVE-2025-12957 is a critical arbitrary file upload vulnerability affecting the All-in-One Video Gallery plugin for WordPress, versions up to and including 4.5.7. This flaw stems from insufficient file type validation, allowing authenticated attackers with author-level access or higher to bypass sanitization by uploading double-extension files disguised as valid VTT files. With a CVSS score of 8.8 (HIGH), this vulnerability poses a significant risk, potentially enabling remote code execution and leading to high impacts on confidentiality, integrity, and availability. While there is no evidence of active exploitation, exploit code is referenced in community discussions, indicating potential for future attacks, and it has a high FAUCET Risk Score of 96/100.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, <= 4.5.7CPE match | cpe:2.3:a:plugins360:all-in-one_video_gallery:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.