CVE-2026-88869: AVideo AD_Server Stored XSS via log.php label parameter
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the ADServer plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter, which is later rendered unsanitized in the admin Ad Types report using jQuery .html(), allowing execution of arbitrary JavaScript in an administrator's browser session.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Administrators who view the AD_Server plugin's Ad Types report are exposed, because the stored label value is rendered in their browser without escaping. An attacker does not need to be authenticated to submit the malicious label.
What does an attacker need to do to exploit it?
The attacker needs to send malicious HTML in the label parameter to the AD_Server plugin's log.php endpoint. Exploitation completes when an administrator later opens the Ad Types report, where the value is inserted using jQuery .html().
How can I determine whether an administrator may already have been affected?
Review label values stored through the AD_Server log.php endpoint, particularly values containing HTML or script-like content. Also determine whether administrators viewed the Ad Types report after suspicious labels were submitted.