CVE-2026-126810 · Package
NO FIX YET · SEE WHAT TO DO
Registered AVideo users can store a crafted About field on their channel that bypasses the feed's HTML filter. The script runs in the browser of any visitor who views the channel feed, including administrators.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running AVideo versions 29.1.0 through 29.7.1 that let registered users create channels. Exposure depends on the feed page rendering the About field; sites with no registration or with the feed disabled are less exposed. The sources do not say whether a default configuration is vulnerable.
Not affected if no-public-registration, other-versions
Who cares avideo, php, self-hosted
29.1.0 through 29.7.1 are listed as affected.feed/index.php renders channel About text through feedHtmlDescription() and rss-style.xsl.29.7.1 (the sources do not name the exact fixed release).WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.