Is CVE-2026-60092 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-60092 being exploited in the wild.

How severe is CVE-2026-60092?

Medium severity, with a CVSS score of 6.1, published 8 July 2026.

Which products and versions are affected?

wwbn/avideo (Packagist) ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo Meet through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8.

Is there a fix for CVE-2026-60092?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-60092 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-60092?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo Meet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-60092: WWBN AVideo Meet plugin stored XSS via User-Agent header

CVE-2026-60092 · Severity: medium · CVSS 6.1 · Published 2026-07-08

The Meet plugin for AVideo, a video sharing and streaming platform, contains a security flaw that allows unauthenticated users to inject malicious scripts into the administrative dashboard. By joining a public meeting with a specially crafted browser identifier, an attacker can target meeting hosts or site administrators. If an administrator views the list of meeting participants, the malicious script executes in their browser, potentially allowing the attacker to perform actions on their behalf or steal sensitive session information.

Technologies: wwbn/avideo (Packagist). Vendors: Packagist, WWBN.

Quick answers

Is CVE-2026-60092 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-60092 being exploited in the wild.
How severe is CVE-2026-60092?: Medium severity, with a CVSS score of 6.1, published 8 July 2026.
Which products and versions are affected?: wwbn/avideo (Packagist) ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo Meet through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8.
Is there a fix for CVE-2026-60092?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-60092 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-60092?: Check whether you run wwbn/avideo (Packagist) or WWBN AVideo Meet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the AVideo Meet plugin due to improper sanitization of the HTTP User-Agent header. When a user joins a public meeting via iframe.php, the Meet_join_log::log() function captures the raw User-Agent string and stores it in the database, bypassing the standard xss_esc() sanitization layer. This data is later retrieved by getMeetInfo.json.php and rendered in the 'Participants' management panel without output encoding (htmlspecialchars). An unauthenticated attacker can join a public meeting with a malicious User-Agent payload; when a meeting host or site administrator views the participant list, the payload executes in their privileged session. The vulnerability was reported as unpatched at the time of disclosure.

Affected products

WWBN AVideo Meet plugin through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8

Identifiers

CVE-2026-60092
GHSA-7cqp-7cfv-6c3q

Timeline

2026-06-22: advisory: GitHub Security Advisory published
2026-07-08: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.