CVE-2026-89256: AVideo Bookmark Plugin XSS Vulnerability

CVE-2026-89256 Overview

CVE-2026-89256 is a stored cross-site scripting (XSS) vulnerability in the AVideo platform's Bookmark plugin. The flaw exists through commit c3edcc274c389816d434acadac07ee78eaf330c1. Chapter names supplied through the bookmark name parameter are concatenated into public watch-page HTML without proper encoding. A video owner can inject malicious JavaScript that executes in the browser of every visitor to the affected video. The payload runs in the AVideo origin, exposing session cookies, authentication tokens, and any client-side data available to authenticated users. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Any authenticated video owner can weaponize a video watch page to execute arbitrary JavaScript against every visitor, enabling account takeover, session theft, and cross-user privilege escalation.

Affected Products

• AVideo (WWBN/AVideo) platform
• Bookmark plugin component
• All builds up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1

Discovery Timeline

• 2026-09-11 - CVE-2026-89256 published to the National Vulnerability Database
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89256

Vulnerability Analysis

The AVideo Bookmark plugin allows video owners to define chapters within a video. Each chapter has a name field that is stored server-side and later rendered on the public watch page. The plugin concatenates the stored chapter name directly into HTML output without HTML entity encoding or contextual output escaping.

Because the injection sink is a public watch page, exploitation does not require the attacker to lure a specific user. Every viewer of the compromised video triggers the payload. The malicious script executes under the AVideo origin, granting it access to document.cookie (when accessible), local storage, and the DOM of authenticated sessions.

An attacker who compromises or registers a video-owner account can weaponize their videos into persistent watering holes targeting administrators, moderators, and regular viewers alike.

Root Cause

The root cause is missing output encoding on user-controlled data. The Bookmark plugin trusts stored chapter names and inserts them into HTML without applying htmlspecialchars() or an equivalent context-aware escaping routine. This is a textbook stored XSS pattern classified under CWE-79.

Attack Vector

Exploitation follows a standard stored XSS workflow. An authenticated user with permission to create bookmarks submits a chapter name containing an HTML or JavaScript payload, such as a <script> tag or an event handler on an injected element. The server persists the raw value. When any user requests the watch page, the server renders the payload directly into the response body, and the browser parses and executes it. See the GitHub Security Advisory GHSA-jggq-mm5m-r5wv and the VulnCheck advisory on the Bookmark plugin XSS for reference details.

Detection Methods for CVE-2026-89256

Indicators of Compromise

• Bookmark or chapter records in the AVideo database whose name column contains <script, onerror=, onload=, javascript:, or encoded variants such as <script.
• Watch-page HTML responses that contain unescaped angle brackets inside chapter-name rendering blocks.
• Outbound requests from viewer browsers to unfamiliar domains sourced from the AVideo watch-page context.
• Unexpected session or credential submissions originating from watch pages.

Detection Strategies

• Query the AVideo database for bookmark and chapter rows containing HTML control characters (<, >, ") or JavaScript keywords in name fields.
• Deploy a Content Security Policy (CSP) in report-only mode and monitor violation reports from watch pages for inline-script and external-script blocks.
• Add web application firewall (WAF) rules that inspect responses on watch-page routes for script tags rendered inside chapter markup regions.

Monitoring Recommendations

• Log and review all bookmark and chapter create or update operations, correlating owner accounts with anomalous payload characters.
• Monitor authentication and administrative endpoints for session use immediately following watch-page visits to potentially compromised videos.
• Alert on privilege changes, password resets, or new administrator sessions initiated shortly after a viewer accessed a flagged video.

How to Mitigate CVE-2026-89256

Immediate Actions Required

• Update AVideo to a build that supersedes commit c3edcc274c389816d434acadac07ee78eaf330c1 and includes the Bookmark plugin fix from advisory GHSA-jggq-mm5m-r5wv.
• Disable the Bookmark plugin on any instance that cannot be patched immediately.
• Audit existing bookmark and chapter records and sanitize or delete entries containing HTML or script content.
• Rotate session cookies and force re-authentication for administrators and moderators who may have visited affected videos.

Patch Information

Refer to the WWBN/AVideo GitHub Security Advisory GHSA-jggq-mm5m-r5wv for the official remediation commit and upgrade guidance. Additional technical context is documented in the VulnCheck advisory.

Workarounds

• Restrict video-owner and bookmark-creation privileges to trusted, verified accounts until the patch is applied.
• Enforce a strict Content Security Policy that blocks inline scripts and restricts script sources to a whitelisted set of origins.
• Place a reverse proxy or WAF rule in front of AVideo to strip or encode <script> fragments in requests targeting bookmark endpoints.

# Example CSP header to mitigate reflected and stored XSS on watch pages
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";