Vulnary
← back to the feed
Critical· 9.3

CVE-2026-88868

A stored cross‑site scripting (XSS) flaw exists in the LiveLinks plugin for AVideo. The plugin saves title and description fields without sanitizing them, allowing a user with canStream permission to inject malicious scripts that run in the browsers of all visitors, including site administrators. This can lead to session hijacking, defacement, or data theft.

publishedSep 10, 2026
last modifiedSep 10, 2026
sourcesNVD
severity · cvss
9.3
critical · how bad it is
exploitation · epss
<1%
17th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Oct 25, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

The LiveLinks plugin for AVideo (any version). Site administrators and users with canStream permission are at risk, as the vulnerability affects all visitors to the live‑link page.

02

Real-world impact

An attacker can inject JavaScript that executes in every visitor’s browser, potentially stealing credentials, hijacking sessions, defacing the site, or redirecting users to malicious sites.

03

Why this severity

The CVSS score of 9.3 reflects the high impact on confidentiality, integrity, and availability, combined with low attack complexity, no authentication required, and the fact that the vulnerability is exploitable over the network with user interaction. The score indicates a critical risk that can affect many users.

04

What to do about it

no official fix yet
interim mitigations
  • Restrict or remove the canStream permission from users who do not need it.
  • Disable or uninstall the LiveLinks plugin if it is not required.
  • Sanitize the title and description fields before storing them to prevent XSS.

No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.

No fix documented in sources

05

Timeline

06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsNone
Privileges requiredLow
User interactionPassive
Confidentiality impactHigh
Integrity impactHigh
Availability impactNone
07

References & advisories

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →