CVE-2026-56347: medium-severity vulnerability in WWBN AVideo
AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site visitors, potentially stealing session cookies or performing unauthorized actions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
WWBN · AVideoRelated CVEs — WWBN AVideo
In the same product, most dangerous first.
CVE-2022-30690CRITICALCVE-2022-30690EPSS 83.7%CVE-2022-30534CRITICALCVE-2022-30534EPSS 75.6%CVE-2022-30547CRITICALCVE-2022-30547EPSS 64.5%CVE-2022-32572CRITICALCVE-2022-32572EPSS 25.3%CVE-2026-33478CRITICALAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionEPSS 13.5%CVE-2023-32073HIGHAVideo command injection vulnerabilityEPSS 6.5%