AVideo CVE-2026-89254

Exploitation requires an authenticated AVideo administrator account able to reach the CustomizeUser plugin's add.json.php endpoint and supply the field_name parameter (PR:L per CVSS). The payload is stored but only triggers when a victim actively views an extra-info page or profile form that renders the value through the typeToHTML function (UI:P) - so it is not zero-interaction. Limiting factors: administrative privilege needed to inject, dependence on the CustomizeUser plugin being present/enabled, and required victim page-view for execution; there is no availability impact (VA:N).

The CVSS 4.0 base score of 9.3 is driven by network vector, low complexity, and the high subsequent-system impact metrics (SC:H/SI:H) that 4.0 assigns to XSS that pivots into a victim's session. In practice the severity is tempered by the fact that injection requires an authenticated administrator (PR:L, arguably admin-level) and the payload fires only when a victim actively loads the affected page (UI:P), so this is not wormable or unauthenticated mass-exploitable. There is no EPSS-elevating signal here - no KEV listing and no published POC - so the realistic threat is a malicious or compromised admin, or an admin whose session is leveraged to persist script against other users/admins, and any operator running AVideo should still patch promptly since the stored payload can escalate to full account/session compromise of higher-privileged viewers.

A malicious or compromised AVideo administrator submits a crafted field_name containing a script payload to the CustomizeUser add.json.php endpoint, which stores it unescaped. When another administrator or user subsequently opens an extra-info page or profile form that renders the value through typeToHTML, the script executes in their browser, enabling session-cookie theft or actions performed as the victim. No public POC is currently identified, and exploitation requires the victim to load the affected page (UI:P).