CVE-2026-88866: WWBN AVideo LoginControl Stored XSS via User-Agent Header

Severity: high (CVSS 8.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-10 · updated 2026-09-15
Weakness: CWE-79

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in the User-Agent header that execute in administrator browsers when viewing the Login History page, allowing script execution within the administrator session.

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-wg67-62q3-2m33
https://www.vulncheck.com/advisories/wwbn-avideo-logincontrol-stored-xss-via-user-agent-header
https://github.com/WWBN/AVideo/security/advisories/GHSA-wg67-62q3-2m33

Get alerted when CVE-2026-88866 or the next vulnerability affects your stack