CVE-2026-92579

AVideo through version 29.0 is affected by a broken access control flaw in its autoCSRFGuard() function. The function maintains a hardcoded allowlist of exempt basenames that are tested without directory context, meaning plugin files whose filenames match core filenames inadvertently inherit CSRF...

PT-2025-30676 · Wwbn +1 · Avideo +1

Name of the Vulnerable Software and Affected Versions: WWBN AVideo version 14.4 WWBN AVideo dev master commit 8a8954ff Description: A cross-site scripting xss issue exists in the LoginWordPress loginForm cancelUri parameter functionality. A crafted HTTP request can lead to arbitrary Javascript...