Vulnerability details
CVE-2026-89254
WWBN AVideo
AVideo CustomizeUser Stored XSS via field_name Parameter
CVSS 4.0
9.3Critical
Official description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field_name parameter is stored raw without sanitization. Administrators can inject malicious scripts via the add.json.php endpoint that execute when viewing extra info pages or profile forms that render the typeToHTML function.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N |
| 8.7High | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| WWBN | AVideo | v ≤ c3edcc274c389816d434acadac07ee78eaf330c1 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-11
- Last updated
- 2026-09-11
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.36%
Probability of exploitation in 30 days
30.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')