CVE-2026-88868 — AVideo LiveLinks Stored XSS via title and description fields
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields ar…
Published: 2026-09-10 · CVSS: 9.3 · CVSS 4.0
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields are stored without sanitization. A user with canStream permission can inject malicious scripts that execute in the browser of every visitor viewing the live-link page, including administrators, within the site origin.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7