CVE-2026-89254
Last modified
CVE-2026-89254 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field_name parameter is stored raw without sanitization. Administrators can inject malicious scripts via the add.json.php endpoint that execute when viewing extra info pages or profile forms that render the typeToHTML function..
Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field_name parameter is stored raw without sanitization. Administrators can inject malicious scripts via the add.json.php endpoint that execute when viewing extra info pages or profile forms that render the typeToHTML function.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| WWBN | AVideo | <= c3edcc274c389816d434acadac07ee78eaf330c1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-89254?
How severe is CVE-2026-89254?
How do I fix CVE-2026-89254?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-89249AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
- CVE-2026-8925The curl logic that works with SASL authentication could end…9.8
- CVE-2026-89250WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…7.5
- CVE-2026-89251AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…6.5
- CVE-2026-89252AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…6.5
- CVE-2026-89253WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…8.7
- CVE-2026-89255AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
- CVE-2026-89256AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
- CVE-2026-89257AVideo through 29.0 contains an insecure direct object refer…5.4
- CVE-2026-89258Hugo is a static site generator. In versions after v0.123.0 …6.3
- CVE-2026-89259Hugo is a static site generator. From v0.161.0, Hugo execute…9.8
- CVE-2026-8926When asking curl to use a `.netrc` file to find credentials …9.1
Are you affected by CVE-2026-89254?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST