# CVE-2026-89256: AVideo Bookmark plugin stored cross-site scripting in chapter names

Source: https://junglewise.ai/threats/cve-2026-89256-avideo-bookmark-plugin-stored-cross-site-scripting-in-chapter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89256 · Severity: high · CVSS 8.7 · Published 2026-09-11

AVideo is a video hosting and streaming platform, and the Bookmark plugin allows video owners to create named chapter bookmarks. A video owner can inject malicious scripts via bookmark names that are not properly encoded, causing every visitor to that video to execute the attacker's JavaScript in the AVideo origin. This enables account compromise, credential theft, and malware distribution to all video viewers.

Technologies: [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-89256 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89256 being exploited in the wild.

**How severe is CVE-2026-89256?** High severity, with a CVSS score of 8.7, published 11 September 2026.

**Which products and versions are affected?** WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

**Is there a fix for CVE-2026-89256?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89256 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-89256?** Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the AVideo Bookmark plugin (CWE-79). The vulnerability exists in the bookmark-saving endpoint (plugin/Bookmark/page/bookmarkSave.json.php), which accepts a chapter name via the `name` parameter and stores it without any HTML encoding. When the video watch page renders, the stored bookmark names are concatenated directly into HTML via generateChaptersHTML() without escaping, allowing any visitor to execute injected JavaScript. Attack requires the attacker to be a video owner (PR:L) and for the victim to visit the affected video page (UI:R), but scope changes to cross-origin (S:C) since the script runs in the AVideo origin. The vulnerability affects all AVideo versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1 and was unfixed at time of disclosure.

## Affected products

- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1

## Timeline

- 2026-09-11: disclosed: Vulnerability published and CVE-2026-89256 assigned
- 2026-08-27: advisory: GitHub Security Advisory GHSA-jggq-mm5m-r5wv published by DanielnetoDotCom

## References

- [https://github.com/WWBN/AVideo/security/advisories/GHSA-jggq-mm5m-r5wv](https://github.com/WWBN/AVideo/security/advisories/GHSA-jggq-mm5m-r5wv)
- [https://www.vulncheck.com/advisories/avideo-bookmark-plugin-stored-xss-via-chapter-names](https://www.vulncheck.com/advisories/avideo-bookmark-plugin-stored-xss-via-chapter-names)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)