CVE-2026-89254: AVideo CustomizeUser Stored XSS via field_name Parameter
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the fieldname parameter is stored raw without sanitization. Administrators can inject malicious scripts via the add.json.php endpoint that execute when viewing extra info pages or profile forms that render the typeToHTML function.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs administrator-level access to submit a crafted field_name value to the CustomizeUser plugin's add.json.php endpoint. Exploitation also requires a user to view an extra info page or profile form that renders the affected typeToHTML function.
What is the impact after successful exploitation?
The injected script is stored and later executes in the browser of users viewing affected pages or forms. The reported impact includes high confidentiality and integrity impact, with scope changed; availability impact is not reported.
How can I determine whether an instance may be affected?
Review whether the AVideo CustomizeUser plugin includes commit c3edcc274c389816d434acadac07ee78eaf330c1 and whether administrators can use add.json.php to create custom fields. Check stored custom-field field_name values for unexpected HTML or script content, especially values that would be rendered on extra info pages or profile forms.