CVE-2026-56347 describes a stored cross-site scripting vulnerability in the AVideo TopMenu plugin up to version 26.0. The issue arises from improper neutralization of input during web page generation, specifically missing output encoding for icon classes, URLs, and text labels in menu items. This flaw enables attackers to inject malicious JavaScript code that executes in the browsers of all site visitors, potentially leading to session cookie theft or unauthorized actions. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. There is no vendor advisory or patch information available at this time, and the product is not a cloud service.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the affected site for all visitors. This can lead to theft of session cookies or performing unauthorized actions on behalf of users. The impact is limited to client-side script execution with medium severity as per the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting input to menu items or applying manual output encoding as a temporary mitigation. Monitor vendor communications for updates.