CVE-2026-89254 WWBN CVE debrief

Who should care

Defenders responsible for AVideo installations, particularly those using the CustomizeUser plugin, should assess exposure and apply patches or mitigations. They should also monitor for suspicious activity on extra info pages and profile forms. The vulnerability allows for stored cross-site scripting, which can lead to malicious script execution.

Why it matters

The CVE-2026-89254 vulnerability in AVideo CustomizeUser plugin allows for stored cross-site scripting. Defenders should assess exposure, apply patches or mitigations, and monitor for suspicious activity. The corpus lacks information on affected versions, exploitation, and remediation.

• Defenders must verify exposure and apply patches or mitigations to prevent exploitation.
• Administrators must monitor for suspicious activity on extra info pages and profile forms.
• The vulnerability allows for stored cross-site scripting, which can lead to malicious script execution.

Technical summary

The AVideo CustomizeUser plugin has a stored cross-site scripting vulnerability. The field_name parameter is stored raw without sanitization, allowing administrators to inject malicious scripts via the add.json.php endpoint. These scripts execute when viewing extra info pages or profile forms that render the typeToHTML function. The vulnerability has a CVSS score of 9.3 and is considered critical. The CVE record and NVD entry provide details on the vulnerability, but information on affected versions, exploitation, and remediation is limited.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations.

Recommended defensive actions

• Verify exposure by checking if the CustomizeUser plugin is in use and if the field_name parameter is being used.
• Apply patches or mitigations provided by the vendor.
• Monitor for suspicious activity on extra info pages and profile forms.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the corpus lacks information on affected versions, exploitation, and remediation. Defenders should verify exposure and apply patches or mitigations. The vulnerability allows for stored cross-site scripting, which can lead to malicious script execution. The CVE-2026-89254 vulnerability in AVideo CustomizeUser plugin allows for stored cross-site scripting. Defenders should assess exposure, apply patches or mitigations, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.