Executive brief
The TopMenu plugin for AVideo, a video sharing platform, contains a security flaw that allows attackers to inject malicious scripts into the website's navigation menus. Because these menus appear on every page, an attacker can target all site visitors to steal login cookies, redirect users to fraudulent websites, or perform unauthorized actions. This can be triggered if an administrator is tricked into visiting a malicious link, even without the attacker having their own account.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the AVideo TopMenu plugin through version 26.0. The root cause is a failure to apply output encoding (such as htmlspecialchars) to user-controlled fields including icon classes, URLs, and text labels within the menu rendering logic (specifically in HTMLMenuRight.php, HTMLMenuLeft.php, and index.php). Furthermore, the menuItemSave.json.php endpoint lacks CSRF protection, allowing an unauthenticated remote attacker to chain CSRF with XSS. By luring an authenticated administrator to a malicious webpage, an attacker can silently inject a script into the global navigation menu. This script then executes in the context of every user who visits any page on the AVideo instance. As of the advisory date, no official patch has been released, though manual remediation via output encoding is recommended.
Affected products
- WWBN AVideo TopMenu plugin <= 26.0
Timeline
- 2026-03-31: advisory: Vendor advisory published on GitHub
- 2026-06-20: disclosed: NVD publication date