CVE-2026-89254

AVideo contains a stored cross-site scripting vulnerability in its CustomizeUser plugin, where the field_name parameter is saved without sanitization. An authenticated administrator (low-privileged account per the CVSS score) can submit a crafted value through the add.json.php endpoint, and the injected script is later executed whenever users load extra info pages or profile forms that render the typeToHTML function. Because the payload persists in the database, an attacker can compromise the browsing session of any user who views those pages, potentially stealing credentials or performing actions in the victim's context. Any AVideo deployment up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected, particularly multi-user video platforms where several administrators or staff accounts can write plugin settings. No public proof-of-concept, kev listing, or in-the-wild exploitation has been reported as of this analysis.

What to do: Update AVideo to a build newer than commit c3edcc274c389816d434acadac07ee78eaf330c1, since no fixed release version is specified in the disclosure data. In the interim, restrict access to the CustomizeUser add.json.php endpoint to trusted administrators only and review stored CustomizeUser field_name values for injected HTML/scripts. Administrators of multi-user instances should prioritize patching because stored payloads will fire for every user who opens the affected extra info or profile pages.