CVE-2026-88869
Deferred Deferred - Pending Action

Stored XSS in AVideo AD_Server Plugin

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD_Server plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter, which is later rendered unsanitized in the admin Ad Types report using jQuery .html(), allowing execution of arbitrary JavaScript in an administrator's browser session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88869
EUVD
EUVD-2026-75419

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (exc)
wwbn ad_server to c3edcc274c389816d434acadac07ee78eaf330c1 (exc)
avideo ad_server *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the AVideo AD_Server plugin. An unauthenticated attacker can inject malicious HTML through the label parameter in the log.php endpoint. The input is stored without sanitization and later rendered unsanitized in the admin Ad Types report using jQuery .html(), allowing arbitrary JavaScript execution in an administrator's browser session.

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to the AD_Server plugin's log.php endpoint with a label parameter containing HTML or JavaScript payloads. Check server logs for unsanitized input in the label parameter. Use tools like curl to test the endpoint: curl 'http://target/plugin/AD_Server/log.php?label=<script>alert(1)</script>' and observe if the payload is stored and rendered unsanitized in the admin Ad Types report.

Impact Analysis

An attacker could execute arbitrary JavaScript in an administrator's browser session. This could allow the attacker to perform actions on behalf of the admin, such as creating users, modifying plugin settings, or altering site configuration. The vulnerability requires the AD_Server plugin to be enabled and a same-origin Referer header for exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access and data manipulation, potentially violating confidentiality and integrity requirements of GDPR and HIPAA. It may result in unauthorized data exposure or modification, leading to compliance breaches and legal consequences.

Mitigation Strategies

Disable the AD_Server plugin immediately if enabled. Implement input validation and output encoding for the label parameter in log.php. Sanitize all user inputs before storage and use textContent instead of .html() in the admin Ad Types report to prevent XSS execution. Monitor for unauthorized admin actions or changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88869. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart