CVE-2026-89254
A stored cross‑site scripting flaw exists in the CustomizeUser plugin of AVideo. The vulnerability allows an attacker to inject JavaScript via the add.json.php endpoint, which is then executed when administrators view certain pages. This can lead to malicious code running in the admin’s browser.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
The CustomizeUser plugin for the AVideo platform (any version that includes the add.json.php endpoint).
Real-world impact
An attacker could inject malicious scripts that run in the browser of anyone who views the affected pages, potentially stealing session cookies, defacing the site, or redirecting users.
Why this severity
The CVSS score of 9.3 reflects the low effort required to exploit (low attack complexity), the need for only local privileges (low privileges), and the high impact on confidentiality, integrity, and availability when the script runs in an admin’s browser. The lack of user interaction and the stored nature of the payload further raise the score.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources