Stored Cross-Site Scripting Vulnerability in AVideo LiveLinks Plugin
CVE-2026-88868

9.3CRITICAL

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
10 September 2026

What is CVE-2026-88868?

The AVideo LiveLinks plugin contains a stored cross-site scripting vulnerability due to improper sanitization of title and description fields. This security flaw allows users with the 'canStream' permission to inject malicious scripts that may execute in the browsers of all visitors, including those of administrators, when they access the live-link page. This poses significant risks as it can lead to unauthorized actions and data exposure, affecting the integrity and security of the site.

Affected Version(s)

AVideo 0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-j...
vendor-advisory
https://www.vulncheck.com/advisories/avideo-livelinks-sto...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

santhreal
.