---
id: CVE-2026-56347
title: >-
  AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item
  Fields
summary: >-
  AVideo TopMenu plugin through version 26.0 contains a stored cross-site
  scripting vulnerability in menu item rendering due to missing output encoding
  of icon classes, URLs, and text labels. Attackers can inject malicious
  JavaScript throu…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: WWBN
product: AVideo
affected:
  - AVideo <= 26.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-22T17:54:45.597733Z'
exploitAvailable: true
published: '2026-06-20'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:05.704Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56347'
references:
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-gmpc-fxg2-vcmq'
    label: GitHub Security Advisory (GHSA-gmpc-fxg2-vcmq)
  - url: >-
      https://www.vulncheck.com/advisories/avideo-topmenu-plugin-stored-cross-site-scripting-via-unescaped-menu-item-fields
    label: >-
      VulnCheck Advisory: AVideo TopMenu Plugin - Stored Cross-Site Scripting
      via Unescaped Menu Item Fields
tags:
  - cve.org
  - exploit-available
epss: 0.002
epssPercentile: 0.09858
ingestedAt: '2026-11-08T14:51:22.353Z'
---

## Overview

AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site visitors, potentially stealing session cookies or performing unauthorized actions.

## Affected

- `AVideo <= 26.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.