Stored Cross-Site Scripting in AVideo TopMenu Plugin by WWBN

CVE-2026-56347

What is CVE-2026-56347?

The AVideo TopMenu plugin, up to version 26.0, is susceptible to a stored cross-site scripting vulnerability. This arises from the absence of proper output encoding for menu item elements, including icon classes, URLs, and text labels. Malicious actors can exploit this flaw by injecting harmful JavaScript through menu item fields that are not properly escaped. When rendered, this script may execute for all visitors of the site, leading to potential session cookie theft or unauthorized actions.

References