Cloudanix VulnDB

GHSA-gmpc-fxg2-vcmq

Medium · 6.1

AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin

CVSS

6.1

EPSS

—

Published

Apr 1, 2026

CISA due date

—

The record

The TopMenu plugin renders menu item fields (icon classes, URLs, and text labels) directly into HTML without applying `htmlspecialchars()` or any other output encoding. Since menu items are rendered on every public page through plugin hooks, a single malicious menu entry results in stored cross-site scripting that executes for every visitor to the site. An admin user who is tricked into saving a crafted menu item (or an attacker who gains admin access) can compromise all site visitors.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities