CVE-2026-88869
A stored cross‑site scripting (XSS) flaw exists in the AD_Server plugin’s log.php endpoint. An unauthenticated attacker can inject malicious HTML via the label parameter, which is later rendered unsanitized in the admin Ad Types report. This allows arbitrary JavaScript to run in an administrator’s browser session.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
The AD_Server plugin for AVideo (specific versions not listed).
Real-world impact
An attacker could run arbitrary JavaScript in an admin’s browser, potentially stealing session cookies, defacing the site, or performing actions on behalf of the admin.
Why this severity
The CVSS score of 9.3 reflects the high impact of the vulnerability: it is exploitable over the network, requires no authentication, and can lead to complete compromise of the administrator’s session. The high confidentiality, integrity, and availability impact scores drive the critical rating.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources