CVE-2026-60092 Details
Description
AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetInfo.json.php endpoint. When a participant joins a public meeting, the raw HTTP User-Agent header is stored (meet_join_log.user_agent) without sanitization (bypassing AVideo's setter-level xss_esc() layer) and later echoed without output encoding (no htmlspecialchars()) in the Participants management panel, which is accessible to the meeting host and site administrators. An anonymous, unauthenticated attacker can join any public meeting while supplying a User-Agent header containing an HTML/JavaScript payload; the payload is persisted and executes in the privileged, authenticated browser session of the meeting host or a site administrator when they open the participant list. The issue was unpatched at the time of the report.
A stored cross-site scripting vulnerability has been identified in the AVideo Meet plugin, specifically in the getMeetInfo.json.php endpoint. This vulnerability allows an anonymous, unauthenticated attacker to inject HTML/JavaScript payloads by manipulating the User-Agent header when joining public meetings. The injected payload is persisted in the meet_join_log.user_agent database field and executed in the browser session of the meeting host or site administrators when they access the Participants management panel. The vulnerability arises because the User-Agent header is stored without proper sanitization, bypassing AVideo's built-in XSS protection, and later displayed without output encoding.
The vulnerability can be fixed by encoding the User-Agent value at the point of retrieval in the getMeetInfo.json.php file, using htmlspecialchars() to ensure proper output encoding. Additionally, the User-Agent should be sanitized on write, similar to how other fields are handled, to prevent unescaped data from being stored in the first place.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-7cqp-7cfv-6c3q | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/WWBN/AVideo/commit/e8d6119f3cb1b849149906efeb0a41fc024f59f8 | [email protected] | Source CodeVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-7cqp-7cfv-6c3q | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/avideo-stored-cross-site-scripting-via-unescaped-user-agent-in-participants-panel | [email protected] | AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= e8d6119f3cb1b849149906efeb0a41fc024f59f8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |