CVE-2026-88868
A stored cross‑site scripting (XSS) flaw exists in the LiveLinks plugin for AVideo. The plugin saves title and description fields without sanitizing them, allowing a user with canStream permission to inject malicious scripts that run in the browsers of all visitors, including site administrators. This can lead to session hijacking, defacement, or data theft.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
The LiveLinks plugin for AVideo (any version). Site administrators and users with canStream permission are at risk, as the vulnerability affects all visitors to the live‑link page.
Real-world impact
An attacker can inject JavaScript that executes in every visitor’s browser, potentially stealing credentials, hijacking sessions, defacing the site, or redirecting users to malicious sites.
Why this severity
The CVSS score of 9.3 reflects the high impact on confidentiality, integrity, and availability, combined with low attack complexity, no authentication required, and the fact that the vulnerability is exploitable over the network with user interaction. The score indicates a critical risk that can affect many users.
What to do about it
- ›Restrict or remove the canStream permission from users who do not need it.
- ›Disable or uninstall the LiveLinks plugin if it is not required.
- ›Sanitize the title and description fields before storing them to prevent XSS.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources