AVideo TopMenu CVE-2026-56347

Q: What is the CVSS score of CVE-2026-56347?

CVE-2026-56347 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38134 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-20 VulnCheck

XSS Avideo

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

CSRF chain eliminates privilege requirement (PR:N); scope changes to all site visitors (S:C); user interaction required for both CSRF admin step and victim page load (UI:R).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 06:27 vuln.today

Analysis Generated

Jun 22, 2026 - 06:27 vuln.today

DescriptionCVE.org

AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site visitors, potentially stealing session cookies or performing unauthorized actions.

AnalysisAI

Stored cross-site scripting in AVideo's TopMenu plugin through version 26.0 allows payload execution for every site visitor due to unescaped rendering of icon classes, URLs, and text labels across multiple PHP templates. Critically, the saving endpoint (menuItemSave.json.php) lacks CSRF token validation despite checking for admin status, enabling a full CSRF-to-stored-XSS chain: an attacker with no account can inject the malicious menu item by luring an authenticated admin to an attacker-controlled page. Publicly available exploit code exists (GHSA-gmpc-fxg2-vcmq); no vendor-released patch has been identified at time of analysis.

Technical ContextAI

AVideo (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) is a PHP-based self-hosted video platform. Its TopMenu plugin hooks into the global page layout, meaning menu items rendered in HTMLMenuRight.php and HTMLMenuLeft.php appear on every public page. The root cause is CWE-79: user-controlled strings (icon class, URL, text label) are echoed directly into HTML output without htmlspecialchars() or equivalent encoding at four confirmed locations. The secondary weakness is missing CSRF protection on menuItemSave.json.php: the endpoint calls User::isAdmin() for authorization but does not invoke isGlobalTokenValid(), so a cross-origin POST from an attacker's page can create menu items on behalf of any currently-authenticated admin without their explicit knowledge.

RemediationAI

No vendor-released patch has been identified at time of analysis; the Composer package lists no fixed version. As the primary compensating control, disable or remove the TopMenu plugin entirely until a patched release is available - this eliminates both the CSRF injection vector and the XSS render surface with no impact on core AVideo functionality. If the TopMenu plugin must remain active, restrict admin account sessions by enforcing short session timeouts and requiring re-authentication before accessing plugin configuration pages, which reduces the CSRF exploitation window. Additionally, deploy a WAF rule to block POST requests to /plugin/TopMenu/menuItemSave.json.php from origins other than the AVideo instance itself; note this is a partial control since same-site navigations bypass simple origin checks. Monitor the GHSA advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-gmpc-fxg2-vcmq and the VulnCheck advisory at https://www.vulncheck.com/advisories/avideo-topmenu-plugin-stored-cross-site-scripting-via-unescaped-menu-item-fields for patch availability. The VulDB entry https://vuldb.com/vuln/372567 may also receive updates.