CVE-2026-56347 AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields
Attackers can inject malicious JavaScript into menu items, executing code for all visitors to steal sessions or perform actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-56347?
CVE-2026-56347 is a medium-severity cross-site scripting vulnerability in WWBN AVideo, published on 20 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site visitors, potentially stealing session cookies or performing unauthorized actions.
Weakness: CWE-79
Which versions are affected by CVE-2026-56347?
2 open source packages ship an affected version, including wwbn/avideo.
| Package | Affected | Fixed in |
|---|---|---|
wwbn/avideo Packagist | All versions to 26.0 | None |
wwbn/avideo Packagist | All versions to 26.0 | None |
How do I fix CVE-2026-56347?
No fix has been published for CVE-2026-56347 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-56347 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56347 exists.
Sources
Also known as GHSA-5226-vrg8-xx79, GHSA-gmpc-fxg2-vcmq.