High severity8.7NVD Advisory· Published Sep 10, 2026· Updated Sep 10, 2026

CVE-2026-88866

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in the User-Agent header that execute in administrator browsers when viewing the Login History page, allowing script execution within the administrator session.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WWBN/Avideoinferred2 versions
<=commit c3edcc274c389816d434acadac07ee78eaf330c1+ 1 more
- (no CPE)range: <=commit c3edcc274c389816d434acadac07ee78eaf330c1
- (no CPE)range: <c3edcc274c389816d434acadac07ee78eaf330c1

Patches

Vulnerability mechanics

References

github.com/WWBN/AVideo/security/advisories/GHSA-wg67-62q3-2m33nvd
www.vulncheck.com/advisories/wwbn-avideo-logincontrol-stored-xss-via-user-agent-headernvd

News mentions

No linked articles in our index yet.

cvss	0.565
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000