CVE-2026-56347: AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields
AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site visitors, potentially stealing session cookies or performing unauthorized actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For the AVideo TopMenu plugin, implement output encoding/escaping for menu item rendering: ensure icon class values, menu item URLs, and text labels are properly HTML-encoded/escaped or sanitized prior to rendering to users to prevent stored XSS.
- Operational
Audit all existing TopMenu plugin menu items for injected JavaScript or malicious payloads and sanitize or remove any suspicious entries. If exploitation is suspected, invalidate affected sessions/cookies and force users to re-authenticate.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56347?
The severity of CVE-2026-56347 is rated as medium with a score of 6.1.
What type of vulnerability is CVE-2026-56347?
CVE-2026-56347 is a stored Cross-Site Scripting (XSS) vulnerability.
How does CVE-2026-56347 affect user security?
CVE-2026-56347 allows attackers to inject malicious JavaScript that executes for all site visitors, compromising user security.
How do I fix CVE-2026-56347?
To fix CVE-2026-56347, ensure that output encoding is applied to menu item fields within the AVideo TopMenu plugin.
Which versions of AVideo are affected by CVE-2026-56347?
AVideo TopMenu plugin versions up to and including 26.0 are affected by CVE-2026-56347.