CVE-2026-89254 WWBN CVE debrief

Who should care

Defenders responsible for AVideo instances, particularly those with administrative interfaces exposed, should assess exposure and prioritize remediation. This includes administrators, security teams, and vulnerability management teams who need to verify and remediate this critical vulnerability to prevent potential script execution and compromise.

Why it matters

Defenders should prioritize verifying and remediating this critical vulnerability in AVideo instances, particularly in administrative interfaces, to prevent potential script execution and compromise.

• Potential execution of malicious scripts in administrative interfaces.
• Possible compromise of AVideo instances through stored cross-site scripting.
• Verification of vulnerability remediation in AVideo CustomizeUser plugin.
• Assessment of exposure in administrative interfaces and user profiles.

Technical summary

The CustomizeUser plugin in AVideo stores the field_name parameter raw without sanitization, allowing administrators to inject malicious scripts via the add.json.php endpoint. These scripts execute when viewing extra info pages or profile forms that render the typeToHTML function. The vulnerability has a CVSS score of 9.3 and is considered critical. Defenders should prioritize verifying and remediating this vulnerability in AVideo instances, particularly in administrative interfaces, to prevent potential script execution and compromise.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in AVideo instances, particularly in administrative interfaces.

Recommended defensive actions

• Verify AVideo instances for the CustomizeUser plugin and assess exposure to the add.json.php endpoint.
• Remediate vulnerable instances by sanitizing the field_name parameter and restricting administrative access.
• Monitor for suspicious activity related to extra info pages and profile forms.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 9.3 and critical severity. The CustomizeUser plugin in AVideo stores the field_name parameter raw without sanitization, allowing administrators to inject malicious scripts via the add.json.php endpoint. These scripts execute when viewing extra info pages or profile forms that render the typeToHTML function. The vulnerability has not been modified since its publication on 2026-09-11T12:16:55.690Z.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.