CVE-2026-56347: AVideo TopMenu Plugin Stored XSS in Menu Rendering

Technical summary

The TopMenu plugin contains a stored XSS flaw (CWE-79) stemming from missing output encoding when rendering menu item properties—specifically icon classes, URLs, and text labels. An attacker with the ability to create or modify menu items can inject unescaped JavaScript that persists in the application and executes in the DOM context of every user session that visits the page. The vulnerability affects all versions through 26.0 and is network-accessible with no authentication requirement for exploitation.

Business impact

Successful exploitation allows attackers to steal session cookies, redirect users to malicious sites, harvest credentials, or perform unauthorized administrative actions on behalf of legitimate visitors. For organizations running AVideo, this creates reputational risk (users' trust in site security) and potential data loss. If the site collects sensitive information from visitors, credential harvesting becomes an immediate concern. The stored nature of the vulnerability means remediation timelines directly correlate to exposure window.

Affected systems

AVideo TopMenu plugin versions through 26.0 are affected. The vulnerability requires the plugin to be installed and active on an AVideo instance. Exposure is limited to sites using this specific plugin; however, given TopMenu is a core navigation component, adoption is likely broad within the AVideo user base.

Exploitability

Exploitability is moderate. The attack requires network access and user interaction (site visitor must load a page containing the injected menu), but no special privileges are needed to inject the payload if the attacker can modify menu item configurations. This might require compromised admin credentials or an unauthenticated menu configuration endpoint, depending on plugin permissions model. Once injected, the payload executes passively for all visitors without additional user action beyond page load.

Remediation

Apply the latest available patch or upgrade to a version of TopMenu newer than 26.0 that addresses output encoding. Immediately upon patching, verify that stored malicious payloads are no longer rendered (they should be displayed as escaped text). As an interim mitigation, restrict who can create or edit menu items to trusted administrators, and audit existing menu configurations for suspicious JavaScript or unusual URLs. Content Security Policy (CSP) headers can also help limit XSS impact by restricting inline script execution.

Patch guidance

Verify the exact patch version available from the AVideo vendor advisory. Apply the update to TopMenu in your production environment during a maintenance window. After patching, perform a full menu configuration audit to identify and remove any injected payloads. Test page load and menu rendering in multiple browsers to ensure the fix does not break legitimate menu functionality. If running multiple AVideo instances, coordinate updates across all deployments.

Detection guidance

Hunt for suspicious entries in menu item configurations—look for JavaScript keywords (script, onclick, onerror, onload), event handlers, or unusual URL schemes (javascript:, data:) in icon classes, URLs, or labels. Monitor browser console errors on pages with TopMenu components for signs of XSS execution. Use web application firewalls to detect and block requests containing common XSS payloads destined for menu management endpoints. If available, enable detailed audit logging on menu create/update operations to track who modified menu items and when.

Why prioritize this

Although the CVSS score of 6.1 is MEDIUM, the stored nature of the vulnerability, broad user exposure via site visitors, and potential for session hijacking warrant prompt attention. Unlike reflected XSS, stored XSS affects every user automatically and persists until remediated. Organizations should prioritize patching within the next maintenance window. The lack of KEV designation does not reduce urgency—it reflects current threat activity visibility, not inherent risk.

Risk score, explained

CVSS 3.1 score of 6.1 (MEDIUM) reflects: network-accessible attack vector, low attack complexity, no privilege requirement, and user interaction needed (site must be visited). Impact is limited to confidentiality and integrity (session theft, unauthorized actions) with no availability impact. Contextually, the stored persistence and broad exposure to site visitors elevates practical risk above the base score; treat this as a high-priority patch candidate even though CVSS nominally rates it MEDIUM.

Frequently asked questions