CVE-2026-88869CWE-79cross-site-scripting

CVE-2026-88869

Critical · published September 10, 2026

CVSS v3.1
9.3
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD_Server plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter, which is later rendered unsanitized in the admin Ad Types report using jQuery .html(), allowing execution of arbitrary JavaScript in an administrator's browser session.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00527 · 43.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-10T18:17Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-h68w-3r38-wmm8 · [email protected]https://www.vulncheck.com/advisories/avideo-ad-server-stored-xss-via-log-php-label-parameter · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-h68w-3r38-wmm8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 13:05Z
    AVideo AD_Server Stored XSS via log.php label parameter
    cvelistv5