CVE-2026-56347 Details
Description
AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site visitors, potentially stealing session cookies or performing unauthorized actions.
A stored cross-site scripting vulnerability has been identified in the AVideo TopMenu plugin, affecting versions through 26.0. The issue arises from the plugin's menu item rendering, which fails to properly encode output for icon classes, URLs, and text labels. This lack of encoding allows attackers to inject malicious JavaScript into unescaped menu item fields. The injected scripts execute for all site visitors, potentially leading to session cookie theft or unauthorized actions.
Users are advised to apply output encoding to all menu item fields in the TopMenu plugin before rendering them in HTML. This can be done by using the htmlspecialchars() function with the appropriate parameters to ensure that special characters are properly escaped.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 20, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-gmpc-fxg2-vcmq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-gmpc-fxg2-vcmq | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/avideo-topmenu-plugin-stored-cross-site-scripting-via-unescaped-menu-item-fields | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= 26.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 20, 2026 | New CVE Received | [email protected] |