CVE-2026-89256
Received Received - Intake

Stored XSS in AVideo Bookmark Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name parameter, and every visitor of that video executes the payload in the AVideo origin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89256
EUVD
EUVD-2026-76068

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
avideo bookmark_plugin *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in AVideo's Bookmark plugin. It occurs because chapter names are not properly encoded before being added to public video watch pages. A video owner can inject malicious scripts via the bookmark name parameter, which then executes for every visitor of that video.

Detection Guidance

To detect this vulnerability, inspect AVideo installations for the Bookmark plugin enabled up to commit c3edcc274c389816d434acadac07ee78eaf330c1. Check for malicious bookmark names containing script tags in chapter names. Review HTML output of watch pages for unescaped chapter names.

Impact Analysis

If you are a visitor to an affected video, the injected script runs in your browser within the AVideo origin. This could lead to theft of session cookies, account takeover, or delivery of malware. Video owners with editing privileges can exploit this to target all viewers, including administrators.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating confidentiality requirements under GDPR and HIPAA. It may result in data breaches, triggering mandatory breach notifications and potential fines for non-compliance with data protection regulations.

Mitigation Strategies

Disable the Bookmark plugin in AVideo if not required. If enabled, update to the latest commit beyond c3edcc274c389816d434acadac07ee78eaf330c1. Implement input sanitization for chapter names to prevent XSS. Monitor for suspicious bookmark names or unexpected script execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89256. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart