CVE-2026-89256: AVideo Bookmark Plugin Stored XSS via Chapter Names
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name parameter, and every visitor of that video executes the payload in the AVideo origin.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability, and who is exposed?
An attacker needs privileges to own or manage a video and to set a bookmark chapter name. Any visitor who loads the affected video's public watch page can execute the stored payload in the AVideo origin.
Does exploitation require visitor interaction?
The vulnerable chapter name is rendered on the public watch page, so a visitor must view the affected video page. The available data does not indicate that the visitor must take any additional action.
How can I identify potentially affected content?
Review bookmark chapter names on videos owned by users who can create or edit video bookmarks, especially names containing HTML or script-like markup. The issue is present in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.