CVE-2026-60092

Name of the Vulnerable Software and Affected Versions AVideo (Meet plugin) versions prior to commit e8d6119f3cb1b849149906efeb0a41fc024f59f8

Description A stored cross-site scripting issue exists in the Meet plugin's 'getMeetInfo.json.php' endpoint. The application stores the raw HTTP User-Agent header in the meet join log.user agent variable without sanitization, bypassing the xss esc() layer. This data is subsequently displayed in the Participants management panel without output encoding via htmlspecialchars(). An unauthenticated attacker can join a public meeting and provide a User-Agent header containing a malicious HTML or JavaScript payload. This payload is then executed within the authenticated session of a meeting host or site administrator when they view the participant list.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.