AVideo TopMenu CVE-2026-56347

The TopMenu plugin must be installed and enabled on the AVideo instance. Initial payload injection requires an authenticated admin to visit an attacker-controlled page while their AVideo session is active (CSRF step); this is the primary limiting factor requiring social engineering. Once injected, the XSS executes for all site visitors with no further conditions because TopMenu hooks into the global page layout. Exploitation is limited to AVideo instances running versions 26.0 or earlier with the TopMenu plugin active. No special server configuration or non-default settings beyond plugin enablement are required. The CSRF chain removes the need for direct admin credentials, but the attacker cannot exploit this fully autonomously without the admin interaction step.

The provided CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P) reflects moderate severity, but several factors elevate real-world priority. First, PR:N in the vector is justified by the CSRF bypass: the attacker requires no credentials of their own, only that an admin visits a crafted page. Second, the stored nature of the XSS means a single successful injection persists and affects all subsequent visitors - a force-multiplier absent from reflected XSS. Third, publicly available exploit code (PoC curl commands in the GitHub Security Advisory) lowers attacker skill requirements substantially. Against these factors, UI:P (passive user interaction) limits immediate mass exploitation; the CSRF step requires social engineering of an admin. No CISA KEV listing is present, and no EPSS data was provided, so widespread automated exploitation is not confirmed. The combination of no available patch, public PoC, and CSRF chain makes this a genuine remediation priority for any AVideo deployment using the TopMenu plugin, despite the moderate CVSS score.

An attacker hosts a webpage containing a hidden cross-origin form that auto-submits a POST to the target AVideo instance's menuItemSave.json.php endpoint with a payload injecting javascript:alert(document.cookie) as the menu item URL. When an AVideo admin visits the attacker's page while authenticated, their session cookie is silently used to save the malicious menu item. Every subsequent visitor to any public page of the AVideo site then executes the attacker's JavaScript, enabling session cookie theft or forced account actions at scale. A full proof-of-concept using curl is publicly documented in GHSA-gmpc-fxg2-vcmq.