CVE-2026-88869 Details

A stored cross-site scripting vulnerability has been identified in AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1. The issue resides in the AD_Server plugin's log.php endpoint, which improperly escapes the label parameter before storing it. This flaw allows unauthenticated attackers to inject malicious HTML that is later rendered without sanitization in the admin Ad Types report, using jQuery .html(). As a result, arbitrary JavaScript can be executed in the context of an administrator's browser session.

The vulnerability can be addressed by updating the log.php endpoint to properly escape the label parameter before storage. Additionally, the Ad Types report should be modified to render the type column as text, rather than as HTML.