CVE-2026-56347: falha de média gravidade em WWBN AVideo
AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.2%
AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site visitors, potentially stealing session cookies or performing unauthorized actions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
WWBN · AVideoCVEs relacionadas — WWBN AVideo
No mesmo produto, das mais perigosas para as menos.
CVE-2022-30690CRITICALCVE-2022-30690EPSS 83.7%CVE-2022-30534CRITICALCVE-2022-30534EPSS 75.6%CVE-2022-30547CRITICALCVE-2022-30547EPSS 64.5%CVE-2022-32572CRITICALCVE-2022-32572EPSS 25.3%CVE-2026-33478CRITICALAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionEPSS 13.5%CVE-2023-32073HIGHAVideo command injection vulnerabilityEPSS 6.5%