CVE-2026-56347: AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-20 · updated 2026-10-25
Weakness: CWE-79

Description

AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site visitors, potentially stealing session cookies or performing unauthorized actions.

Affected products

WWBN AVideo: through 26.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-gmpc-fxg2-vcmq
https://www.vulncheck.com/advisories/avideo-topmenu-plugin-stored-cross-site-scripting-via-unescaped-menu-item-fields
https://github.com/WWBN/AVideo/security/advisories/GHSA-gmpc-fxg2-vcmq

Get alerted when CVE-2026-56347 or the next vulnerability affects your stack