CVE-2026-89256 WWBN CVE debrief

Who should care

Defenders responsible for AVideo instances, especially those with public watch pages or user-generated content, should assess exposure and prioritize remediation. This includes verifying the presence of vulnerable versions, applying patches or mitigations, and monitoring for suspicious activity. Security teams and vulnerability management teams should also review the vulnerability's impact on their organization's assets and prioritize remediation efforts.

Why it matters

A stored cross-site scripting vulnerability in AVideo's Bookmark plugin allows video owners to inject malicious scripts, executing payloads on visitors. Defenders should prioritize verification and remediation, especially for public watch pages or user-generated content.

• Defenders must verify and remediate vulnerable AVideo instances to prevent payload execution.
• Exposure to public watch pages or user-generated content increases the risk of payload execution.
• Remediation priority is high due to the critical CVSS score of 9.3.
• Additional monitoring and verification may be necessary to ensure patch effectiveness.

Technical summary

The vulnerability exists in the Bookmark plugin of AVideo, where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name parameter, leading to payload execution on every visitor of that video in the AVideo origin. This issue arises from the lack of proper input validation and sanitization in the plugin's code. The vulnerability is critical, with a CVSS score of 9.3, indicating a high severity level. AVideo instances with public watch pages or user-generated content are particularly at risk.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially for AVideo instances with public watch pages or user-generated content.

Recommended defensive actions

• Verify AVideo instances for exposure to public watch pages or user-generated content
• Remediate vulnerable AVideo instances by applying patches or mitigating factors
• Monitor AVideo instances for suspicious activity or payload execution
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was discovered in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The CVE record and NVD entry provide details on the vulnerability, but additional information from the vendor or other sources is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.