PT-2026-51177 · Wwbn · Avideo

Adrgs · Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-56347

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo TopMenu plugin versions prior to 26.1

Description A stored cross-site scripting issue exists in menu item rendering caused by missing output encoding of icon classes, URLs, and text labels. This allows attackers to inject malicious JavaScript through unescaped menu item fields, which then executes for all site visitors. This can lead to the theft of session cookies or the performance of unauthorized actions.

Recommendations Update the AVideo TopMenu plugin to a version later than 26.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-56347

Affected Products

Avideo

References · 6

• https://github.com/WWBN/AVideo/security/advisories/GHSA-gmpc-fxg2-vcmq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56347 · Security Note
• https://twitter.com/CVEnew/status/2068466525900566895 · Twitter Post
• https://vulncheck.com/advisories/avideo-topmenu-plugin-stored-cross-site-scripting-via-unescaped-menu-item-fields · Note
• https://twitter.com/infoflowcloud/status/2068467874369323486 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2068462400068632605 · Twitter Post