CVE-2026-56347 is a stored cross-site scripting vulnerability in the WWBN AVideo TopMenu plugin up to version 26.0. It results from improper neutralization of input during web page generation, specifically due to missing output encoding of icon classes, URLs, and text labels in menu items. Attackers can exploit this by injecting malicious JavaScript code into these fields, which then executes in the browsers of all site visitors. This can lead to theft of session cookies or unauthorized actions performed on behalf of users. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the affected site for all visitors. This can result in theft of session cookies or performing unauthorized actions, potentially compromising user accounts and site integrity. The impact is limited to the scope of the affected plugin and depends on the privileges of the affected users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin or sanitizing input fields manually if possible. Monitor vendor channels for updates and apply patches promptly once released.