# CVE-2026-56347: WWBN AVideo TopMenu plugin stored XSS in menu rendering

Source: https://junglewise.ai/threats/cve-2026-56347-wwbn-avideo-topmenu-plugin-stored-xss-in-menu-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-20. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-56347 · Severity: medium · CVSS 6.1 · Published 2026-06-20

The TopMenu plugin for AVideo, a video sharing platform, contains a security flaw that allows attackers to inject malicious scripts into the website's navigation menus. Because these menus appear on every page, an attacker can target all site visitors to steal login cookies, redirect users to fraudulent websites, or perform unauthorized actions. This can be triggered if an administrator is tricked into visiting a malicious link, even without the attacker having their own account.

Technologies: [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo), [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-56347 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56347 being exploited in the wild.

**How severe is CVE-2026-56347?** Medium severity, with a CVSS score of 6.1, published 20 June 2026.

**Which products and versions are affected?** wwbn/avideo (Packagist) ECOSYSTEM:introduced=0,last_affected=26.0; WWBN AVideo <= 26.0; WWBN TopMenu plugin <= 26.0.

**Is there a fix for CVE-2026-56347?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-56347 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-56347?** Check whether you run wwbn/avideo (Packagist), WWBN AVideo or WWBN TopMenu plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the AVideo TopMenu plugin through version 26.0. The root cause is a failure to apply output encoding (such as htmlspecialchars) to user-controlled fields including icon classes, URLs, and text labels within the menu rendering logic (specifically in HTMLMenuRight.php, HTMLMenuLeft.php, and index.php). Furthermore, the menuItemSave.json.php endpoint lacks CSRF protection, allowing an unauthenticated remote attacker to chain CSRF with XSS. By luring an authenticated administrator to a malicious webpage, an attacker can silently inject a script into the global navigation menu. This script then executes in the context of every user who visits any page on the AVideo instance. As of the advisory date, no official patch has been released, though manual remediation via output encoding is recommended.

## Affected products

- WWBN AVideo TopMenu plugin <= 26.0

## Identifiers

- CVE-2026-56347
- GHSA-gmpc-fxg2-vcmq

## Timeline

- 2026-03-31: advisory: Vendor advisory published on GitHub
- 2026-06-20: disclosed: NVD publication date

## References

- [https://github.com/WWBN/AVideo/security/advisories/GHSA-gmpc-fxg2-vcmq](https://github.com/WWBN/AVideo/security/advisories/GHSA-gmpc-fxg2-vcmq)
- [https://www.vulncheck.com/advisories/avideo-topmenu-plugin-stored-cross-site-scripting-via-unescaped-menu-item-fields](https://www.vulncheck.com/advisories/avideo-topmenu-plugin-stored-cross-site-scripting-via-unescaped-menu-item-fields)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)