CVE-2026-56347

Name of the Vulnerable Software and Affected Versions AVideo TopMenu plugin versions prior to 26.1

Description A stored cross-site scripting issue exists in menu item rendering caused by missing output encoding of icon classes, URLs, and text labels. This allows attackers to inject malicious JavaScript through unescaped menu item fields, which then executes for all site visitors. This can lead to the theft of session cookies or the performance of unauthorized actions.

Recommendations Update the AVideo TopMenu plugin to a version later than 26.0.