# CVE-2026-60092: WWBN AVideo Meet plugin stored XSS via User-Agent header

Source: https://junglewise.ai/threats/cve-2026-60092-wwbn-avideo-meet-plugin-stored-xss-via-user-agent-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-60092 · Severity: medium · CVSS 6.1 · Published 2026-07-08

The Meet plugin for AVideo, a video sharing and streaming platform, contains a security flaw that allows unauthenticated users to inject malicious scripts into the administrative dashboard. By joining a public meeting with a specially crafted browser identifier, an attacker can target meeting hosts or site administrators. If an administrator views the list of meeting participants, the malicious script executes in their browser, potentially allowing the attacker to perform actions on their behalf or steal sensitive session information.

Technologies: [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-60092 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-60092 being exploited in the wild.

**How severe is CVE-2026-60092?** Medium severity, with a CVSS score of 6.1, published 8 July 2026.

**Which products and versions are affected?** wwbn/avideo (Packagist) ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo Meet through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8.

**Is there a fix for CVE-2026-60092?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-60092 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-60092?** Check whether you run wwbn/avideo (Packagist) or WWBN AVideo Meet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the AVideo Meet plugin due to improper sanitization of the HTTP User-Agent header. When a user joins a public meeting via iframe.php, the Meet_join_log::log() function captures the raw User-Agent string and stores it in the database, bypassing the standard xss_esc() sanitization layer. This data is later retrieved by getMeetInfo.json.php and rendered in the 'Participants' management panel without output encoding (htmlspecialchars). An unauthenticated attacker can join a public meeting with a malicious User-Agent payload; when a meeting host or site administrator views the participant list, the payload executes in their privileged session. The vulnerability was reported as unpatched at the time of disclosure.

## Affected products

- WWBN AVideo Meet plugin through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8

## Identifiers

- CVE-2026-60092
- GHSA-7cqp-7cfv-6c3q

## Timeline

- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: NVD publication date

## References

- [https://github.com/WWBN/AVideo/commit/e8d6119f3cb1b849149906efeb0a41fc024f59f8](https://github.com/WWBN/AVideo/commit/e8d6119f3cb1b849149906efeb0a41fc024f59f8)
- [https://github.com/WWBN/AVideo/security/advisories/GHSA-7cqp-7cfv-6c3q](https://github.com/WWBN/AVideo/security/advisories/GHSA-7cqp-7cfv-6c3q)
- [https://www.vulncheck.com/advisories/avideo-stored-cross-site-scripting-via-unescaped-user-agent-in-participants-panel](https://www.vulncheck.com/advisories/avideo-stored-cross-site-scripting-via-unescaped-user-agent-in-participants-panel)

## Related threats

- [WWBN AVideo OS command injection in sanitizeFFmpegCommand](https://junglewise.ai/threats/cve-2026-55173-wwbn-avideo-os-command-injection-in-sanitizeffmpegcommand)
- [WWBN AVideo signature verification bypass in Authorize.Net webhook](https://junglewise.ai/threats/cve-2026-33731-wwbn-avideo-signature-verification-bypass-in-authorize-net)
- [WWBN AVideo sensitive information disclosure in Docker configuration](https://junglewise.ai/threats/cve-2026-33692-wwbn-avideo-sensitive-information-disclosure-in-docker)
- [WWBN AVideo stored DOM XSS in YPTSocket plugin](https://junglewise.ai/threats/cve-2026-54458-wwbn-avideo-stored-dom-xss-in-yptsocket-plugin)
- [WWBN AVideo stored XSS in YouTubeAPI plugin](https://junglewise.ai/threats/cve-2026-50183-wwbn-avideo-stored-xss-in-youtubeapi-plugin)