# CVE-2026-88869: AVideo AD_Server stored XSS in log.php label parameter

Source: https://junglewise.ai/threats/cve-2026-88869-avideo-ad-server-stored-xss-in-log-php-label-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88869 · Severity: critical · CVSS 9.3 · Published 2026-09-10

AVideo is a video platform with an optional AD_Server plugin that tracks advertising campaigns. An unauthenticated attacker can inject malicious JavaScript code through an unprotected tracking endpoint, which is then executed when administrators view advertising reports. This allows an attacker to hijack administrator accounts and take full control of the video platform, including user management and site configuration.

Technologies: [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-88869 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88869 being exploited in the wild.

**How severe is CVE-2026-88869?** Critical severity, with a CVSS score of 9.3, published 10 September 2026.

**Which products and versions are affected?** WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 with AD_Server plugin enabled.

**Is there a fix for CVE-2026-88869?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88869 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88869?** Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the AD_Server plugin's log.php endpoint. The vulnerability occurs because user input from the `label` parameter is copied directly into the database without sanitization via xss_esc(). When administrators view the Ad Types report, this stored payload is rendered using jQuery's .html() method, which interprets and executes the injected HTML and JavaScript. No authentication is required to send the malicious request, only a same-origin Referer header (satisfied by normal browser behavior). The attacker's JavaScript runs in the administrator's browser session with full access to the site origin, enabling account takeover and site compromise. As of the advisory date, no patch was available.

## Affected products

- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 with AD_Server plugin enabled

## Timeline

- 2026-08-26: disclosed: GitHub Security Advisory GHSA-h68w-3r38-wmm8 published
- 2026-09-10: advisory: CVE-2026-88869 assigned and published

## References

- [https://github.com/WWBN/AVideo/security/advisories/GHSA-h68w-3r38-wmm8](https://github.com/WWBN/AVideo/security/advisories/GHSA-h68w-3r38-wmm8)
- [https://www.vulncheck.com/advisories/avideo-ad-server-stored-xss-via-log-php-label-parameter](https://www.vulncheck.com/advisories/avideo-ad-server-stored-xss-via-log-php-label-parameter)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)